my $sql = 'UPDATE table SET '
    . join (',', map {"$_=?"} @ffs)
    . 'WHERE tbl.field=?';
# check the string '$sql' -- you used 'table' in the FROM, but 'tbl' in the WHERE
my $sth = $db->prepare( $sql );
$sth->execute( @cols{@ffs}, $lname );