The bindvars support of the PostgreSQL driver is modeled after the Oracle bindvars support to provide compatibility. In Oracle, only scalar values are allowed (no Tcl arrays, dicts, etc.).
The OpenACS API supports the "-bind" argument to db_foreach, such one can write like:
db_foreach select_groups {
select ap.package_id, ...
from ...
where r.object_id_two = :user_id
...
} -bind [list user_id $auth_info(user_id)] {
}
or even
db_foreach select_groups {
select ap.package_id, ...
from ...
where r.object_id_two = :user_id
...
} -bind [array get auth_info] {
}
The advantage of the explicit list of bind names and values is that these can be passed around between procs without the danger of interfering with other Tcl variables. When when the variables and values form a Tcl dict, also "dict foreach" can be used.
PS: It seems that the "-bind" functionality for db_foreach was lost over the years. i've just committed a patch to oacs-5-10 to revive it.