I don't think this has been stated yet, which surprises me because I saw it mentioned in the CB an hour ago:

The bind_param method is a method of statement handle objects. So is the execute method, as well as the fetchrow_array method. The prepare method is a database handle object method. So your code would be better written as:

my $sth = $database->prepare($query) or croak $database->errstr;
$sth->bind_param( ':user', $user ) or croak $sth->errstr;
$sth->bind_param( ':num', $num ) or croak $sth->errstr;
( $user_type, $user_num ) = $sth->fetchrow_array;
[download]

In your case, $db is holding a statement handle. But I think that's a confusing choice of variable name; it defies the convention demonstrated in the DBI documentation, and makes it hard to guess whether it represents a database handle (your $database variable), or a statement handle. That's just a style/maintainability issue. The big issue I see is using database handles to call statement-handle object methods. That's not going to do what you want.