Hi,
Instead of having a environment variable, you can have a script suchas as connect.sql that does:
connect oracle_user/password@oracle_sid
sqlplus -s /nolog << EOF
start connect.sql
execute
EOF
You can the connect.sql file permissions so that other users cannot read it.
But as said garysadler OS authentication can be better.
Regards,
Franck.