The best approach is then to create the SQL dynamically but to still use placeholders:

my %query_columns = (
    value1 => 'foo',
    value2 => 'bar',
);

my @search_values;
my @expressions;

for (sort keys %query_columns) {
    push @search_values, $query_columns{ $_ };
    push @expressions, "$_ = ?";
};

my $sql_expression = join " and ", @expressions;

my $sql_find_rows = join "\n",
     "select value1, value2, ... from mytable",
     "where ($sql_expression)";

my $fetch = $dbh->selectall_arrayref($sql_find_rows, @search_values);
[download]

The module SQL::Abstract does this, or something very similar. Before using SQL::Abstract, you should think long and hard about whether your SQL will always stay simple like this or whether you will later on need complex join conditions or renaming columns etc. - I prefer to keep most of the SQL as strings, as all abstractions that allow some language syntax to be translated to SQL fail on not so weird corner cases.