state = 'CA'

##</code><code>##

  my $sql = "SELECT city FROM table WHERE state = ?";
  my $sth = $dbh->prepare($sql);
  $dbh->execute($FORM{state});

##</code><code>##

  1; drop table database

##</code><code>##

  use CGI;

  my $cgi = CGI->new();
  ...
  my $sth = $dbh->prepare($sql);
  $sth->execute($cgi->param('state')) or die ...