my $sql = "select * from users where username=?"; # GOOD
my $sth_user = $dbh->prepare_cached($sql)
    or die "can't prepare SQL:" . $dbh->errstr();
$sth_user->execute( $username );