You only need to bind each name once. Your while loop would bind multiple occurances of ':p0' multiple times. Shouldn't hurt, but is a waste. Would be better to keep track of what you've bound with a hash, or better yet, know what parameters need to be bound for each sql statement, and just bind those rather than scanning through the statement to find them.
And internally, Oracle seems to translate '?' placeholders into ':p0', ':p1', ':p2', etc., though you can not mix named with unnamed placeholders.
