Your error message indicates that $sth is undefined.

If $sth is undefined, it is because $dbh->prepare($sql) failed and returned undef.

If $dbh->prepare($sql) failed, it is because the database returned an error.

If the database returned an error, it is probably because the query in $sql is not valid in its dialect of SQL, but it could be something else. Checking for a DBI error on the prepare is the only way to find out:

my $sth = $dbh->prepare($sql) or die "SQL Error: $DBI::errstr\n";
   $sth->execute() or die "SQL Error: $DBI::errstr\n";
[download]

Turning on your $dbh's RaiseError or PrintError flag would also work, since those implicitly check for and report database errors after every DBI call. But, regardless, the only way to find out why your prepare fails is to check for database errors.