It's been a while since I've used Oracle as a backend, but I've never had problems with ampersands through DBI -- the problem only came up when I tried running it through SQL*Plus -- I'm fairly certain that the ampersand issue is a function of SQL*Plus, and not a function of Oracle Database.

Are you using placeholders for the insert/update/whatever? Normally, it's much easier to deal with strings through placeholders, as DBD::Oracle will handle whatever escaping needs to be done.

I believe that 'set define' and 'set escape' are SQL*Plus commands, and as you're not going through SQL*Plus, Oracle Database doesn't know how to handle them. (I would assume 'set editfile' and 'set sqlprompt' would choke as well)