The following seems to work for anything except references to subroutines (maybe another monk can figure out how to get around that, if it's important to you).

This assumes that the strings returned from your database actually do use single quotes in a consistent way around the citations of variables. (The snippet below demonstrates that references to subroutines do not work the way you'd want.)

#!/usr/bin/perl

use strict;
use warnings;

my %in;
my %out;
my $testsub;
my $constant = "fixed";

$in{cid} = 12345;
$out{this}{that}[0] = 678;
$testsub = sub { return "this is foobar" };

print "normally, \$testsub returns: " . &$testsub . "\n\n";
while (<DATA>) {
    s/(?<=')(\$[^']+)/(ref($1) eq 'CODE') ? &{$1} : $1/ee;
    print;
}

__DATA__
select field from table where id!='$in{cid}'
update table set field = null where id = '$out{this}{that}[0]'
delete from table where value = '$constant'
select something from somewhere where status='$testsub'
[download]

Here's what I get when I run that:

normally, $testsub returns: this is foobar

select field from table where id!='12345'
update table set field = null where id = '678'
delete from table where value = 'fixed'
select something from somewhere where status='CODE(0x7ff80903f0e8)'
[download]

UPDATE: Just to be clear about the subroutine reference problem: I get the same output with this simpler substitution:

    s/(?<=')(\$[^']+)/$1/ee;
[download]

I've tried a few variations in the DATA line(&$testsub etc.), but to no avail.