my $qs = 'insert into Promotions (' . join(',', keys %{$hash->{promoti
+on}} ) .
    ',Date_Created,Date_Modified) values (' .
    join(',', ('?') x scalar( keys %{$hash->{promotion}} ) ) .
    ',SYSDATE,SYSDATE)';

$sth = $dbh->prepare( $qs );
$sth->execute( @{$hash->{promotion}}{ keys %{$hash->{promotion}} } );
[download]

You'll note that my two SYSDATE entries are not part of the bind parameters because I'd expect bind to escape them as strings. When I do a dump of $hash->{promotion} (not quite the same data as I was using in my earlier example):

$VAR1 = {
          'Title' => 'Signup PagePoints',
          'Trigger_Value' => '',
          'Uses_Maximum' => 0,
          'Reward_Type' => '5',
          'Reward_Quantity' => '50',
          'Trigger_Quantity' => '',
          'Uses_PerCustomer' => '1',
          'Promotion_Phrase' => '50 free page points at signup!',
          'Status' => 0,
          'Date_Start' => undef,
          'Trigger_Type' => '4',
          'ID' => '1',
          'Date_End' => undef,
          'Reward_Value' => ''
        };
[download]