title: How to use curly brace escaping for Oracle
body: <p>According to <a href="https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet#Oracle_10g_escaping" rel="nofollow">this link</a>, I should be able to use curly braces to escape an entire variable string. My understanding is that Oracle (10g or later -- I've been told we use 11g) should treat this (sanitized) SQL query:</p>
  
  <pre><code>SELECT * FROM customer WHERE name = 'Sam'
  </code></pre>
  
  <p>the same as it treats this one:</p>
  
  <pre><code>SELECT * FROM customer WHERE name = '{Sam}'
  </code></pre>
  
  <p>I tried it as a sanity check before trying strings that would actually need escaping, and it didn't work. The top query returns data, but the bottom doesn't. Am I doing something wrong?</p>