I'm echoing bart here: You should always use bind variables when you query your Oracle database. I find the articles on asktom.oracle.com very helpful in explaining why and how it should be used.
Comment on Re: Oracle Placeholder Problem in my Perl Script