When using OCIBindByName, strings of zero length can't be bound. This is a
major problem for me because I use bind-variables for input from
the user, to prevent the input from being interpreted as SQL.

It must be possible to insert a string of zero length. Whether that is treated as NULL
or not should be left to the database if possible.

It seems that this change between 3.1.14 and 4.0 RC1 occurred because strings 
are now being passed to the OCI C library's OCIBindByName() as type SQLT_CHR 
instead of SQLT_STR. OCIBindByName() does not seem to accept a value of 0 for 
'value_sz' when the type is SQLT_CHR, and there is no '\0' at the end of the
string to look for.

Let me know if there's anything I can do to help. This is preventing us
from really testing RC1.

/* EXAMPLE SCRIPT 1 (assume $conn is an open connection) */
$val = "";

$stmt = OCIParse($conn, "select ''||:v_bind||'' from dual");
OCIBindByName($stmt, ":v_bind", &$val, -1);   /* comes from  ->value.str.len */
   /*** RESULT: Warning bindlength == 0 (Correct behaviour as in 3.1.14) */
OCIExecute($stmt);
   /*** RESULT: ORA-01008 not all variables bound (problem...) */
OCIFreeStatement($stmt);

/* EXAMPLE SCRIPT 2 */
$stmt = OCIParse($conn, "select ''||:v_bind||'' from dual");
OCIBindByName($stmt, ":v_bind", &$val, 0); /* Explicitly of zero length */
    /*** RESULT: ORA-01009: missing mandatory parameter */
OCIExecute($stmt);
    /*** RESULT: ORA-01008: not all variables bound */
OCIFreeStatement($stmt);