Note that choroba's posted code uses $dbh->quote_identifier on the column names which should cover that concern.

(The truly paranoid - and this is a case where being paranoid is generally a good thing! - may wish to also do their own checks on the column names, but it shouldn't be necessary unless DBD::SQLite's quote_identifier has a major bug which has somehow gone undiscovered.)