https://metacpan.org/pod/DBI#Placeholders-and-Bind-Values

The prepare method simply takes valid SQL statement and readies it for submission to the database. What happens underneath is dependant on the DBI you are useing(mySQL, SQLite, Oracle....whatever). I generally prefer to place my query in a string variable, which I usually call $q and then hand that to the prepare method.

my $q = qq(select myfield from mytable order by mydate);
my $sth = $dbh->prepare($q);
[download]

(not tested) there are other considerations related to security, but to start, that is the basic requirement.

hope that is helpful....

In the semantics of the situation, “prepare” is supposed to correspond to the step when the SQL string is transformed into an execution-plan that can be carried out one-or-more times, using different placeholders (which are merely “inputs”), without the overhead of recalculating the execution plan.   A module on the server-side known as the “query optimizer” constructs the plan.

Exactly. If you will be executing a statement multiple times, you only need prepare it once. This will save time.

$update=<<UPDATE;
update foo
set bar = ?
where id = ?
UPDATE

$dbstmt = $dbhandle->prepare($update);

foreach $recid (keys %records) {
  $dbstmt->execute($newvalues{$recid}, $recid);
}
[download]

1 Peter 4:10