use My::DBI qw< quotestr >;  # Also does 'use DBI;'

my $dbh = DBI->connect( ... );
my $data = $dbh->selectall_arrayref(
    sprintf $sql, map { quotestr($dbh,$_) } @params );