We've used patched Mantis 1.1.2 -> 1.1.7 with Oracle 10g, and the binding part (by name, we don't use binding by position) always worked. By default, the 1.1.x series doesn't use binding at all to my knowledge.

Maybe 10g client with 9i db causes the problem, I'm not sure...

Tried 10g db with 10g client - same thing.

Last queries from trace:
|........|
|........|
|........|
|..4SELEC|
|T.*.....|
|..FROM.m|
|_user_t.|
|......WH|
|ERE.user|
|name=:1.|
|........|
|........|

...

|........|
|........|
|....'ORA|
|-01008:.|
|........|

ORA-01008 means "not all variables bound".

Problem is in the _query code within adodb-oci8 code
Where the bindbyname is done, it is using the array indice as the binding reference, ie: OCIBindByName($stmt,":$k",$inputarr[$k],$len);
However within the array k starts at 0.
Within the sql statement the bind variable starts with :1, so they are always off by 1.

The code within _query is correct. The problem appears to be that the
$g_db_param_count was not always reset for a new statement, so the db_param() call was not starting at :0 for the first parameter.
ie: query for login screen was being generated as
SELECT FROM m_user_tbl WHERE username=:1
instead of
SELECT FROM m_user_tbl WHERE username=:0
In particular examine user_api.php
$g_db_param_count should always be reset to zero at the start of a new statement.

Partial fix is to reset g_db_param_count within db_query_bound procedure, ie:

function db_query_bound( $p_query, $arr_parms = null, $p_limit = -1, $p_offset = -1 ) {
global $g_queries_array, $g_db, $g_db_log_queries, $g_db_param_count;

# reset global db_param count for next query R. Armstrong Dec 7 2009
$g_db_param_count = 0;