Placeholders are definitely the way to go. However there is another approach
that can be useful for situations where you can't use
palceholders. The only
example that comes to mind of a time where you can't use placeholders
is
"selet * from foo where bar in (?)"
where you want to specify a list with an unknown number of
elements for ?.
The DBH quote function will quote a variable apropriately for the
DB that your handle is connected to, escaping all necessary metacharacters, etc....
my $s=$dbh->quote($a);