The defined values for the db:parameter-name-substitution attribute are:
false: parameters names may be replaced by a "?".
true: parameters names shall be replaced by a "?".
True and false seem very similar, is this intentional ? Or is it just a typo and should false read "..may NOT..." ?