Depending on the database, the sql may get passed along as is, with all '?'s intact. For the others, you'll have to dig through the DBD code to see what happens. As for your questions, these may not be exactly what you want, but:

1. There's the quote method...

2. There's $sth->{Statement}