in reply to Re^7: DBI do() SQL injection
in thread DBI do() SQL injection

No, please don't. Use quote_identifier for table and column names.
Whoops! Good catch, and thanks for the correction!