The best approach is then to create the SQL dynamically but to still use placeholders:

my %query_columns = (
    value1 => 'foo',
    value2 => 'bar',
);

my @search_values;
my @expressions;

for (sort keys %query_columns) {
    push @search_values, $query_columns{ $_ };
    push @expressions, "$_ = ?";
};

my $sql_expression = join " and ", @expressions;

my $sql_find_rows = join "\n",
     "select value1, value2, ... from mytable",
     "where ($sql_expression)";

my $fetch = $dbh->selectall_arrayref($sql_find_rows, @search_values);
[download]

The module SQL::Abstract does this, or something very similar. Before using SQL::Abstract, you should think long and hard about whether your SQL will always stay simple like this or whether you will later on need complex join conditions or renaming columns etc. - I prefer to keep most of the SQL as strings, as all abstractions that allow some language syntax to be translated to SQL fail on not so weird corner cases.

Thank you. I'go into it!