replace SQL placeholders with OCI named parameters