To pass variable values to Oracle SQL you can embed ${} syntax in SQL code inlined as here document.
To retrieve data from a table you can select your values and put a separator in between (I often use a comma as separator); the rows are coming out from sqlplus standard output and you can capture and separate the values using the built in command read.
I can only say that this works with the korn shell; bash should be ok also.

Code:

#!/bin/ksh

# set here USER PASS DBNAME and MYVAR

$ORACLE_HOME/bin/sqlplus -s << SQLEND
set pagesize 0 feedback off tab off termout off
connect ${USER}/${PASS}@${DBNAME}

var myvar varchar2(99)
exec :myvar := '${MYVAR}';

select COL1||','||COL2||','||COL3
from TABLE
where COL1 = :myvar;

quit
SQLEND | IFS=',' while read col1 col2 col3; do
  # do whatever you want with $col1 $col2 $col3
done

Perhaps I forgot to set some sqlplus variable besides pagesize and the others. The point is to make sqlplus to output only the table rows and nothing more.

Passing credentials to sqlplus directly on the command line allows everyone to learn the password if they can execute the ps command, therefore I prefer to use an explicit connect command inside the sql block.

:myvar is a bind variable. Using a bind variable instead of embedding ${MYVAR} directly into the query has an advantage, namely the query text does not change between successive executions of the sql section even if the value of MYVAR does change; this allows the Oracle optimizer to recognize that the query to be parsed is one that it has already seen and so it does not (hard) parse it again.

Of course if the query is guaranteed to output only one row -- or the rows are ordered (by order by! There are no other means to ensure a particular order) and you are interested only in the first row -- you can do without the while loop:

Code:

SQLEND | IFS=',' read col1 col2 col3
# do whatever you want with $col1 $col2 $col3

Another way to capture sqlplus output is to redirect it into a file, perhaps because the query output is already in a form that can be sourced by the shell:

Code:

select 'export '||COL2||'='||COL3
from TABLE
where COL1 = :myvar;

quit
SQLEND > /tmp/env$$
source /tmp/env$$

Or you can capture the whole output in a shell variable and then eval it:

Code:

sqlout=$($ORACLE_HOME/bin/sqlplus -s << SQLEND
...
SQLEND)
eval $sqlout

I am not sure if this is the correct way to combine the here document construct with the $() syntax, but I remember they can be made to work together.

The bottom line is that you don't need to ask Oracle to open a file, because the data is already coming out from sqlplus standard output.

And, please, don't use a PL/SQL block to output query results via dbms_output, this is just plain silly because sqlplus already does that for you.