You say: You are not using placeholders, so without seeing the data who knows what the query is actually doing?

The code for the query:

my $statement = "update $sql_user_table set $passpart $mailpart $secre
+tpart $wherepart";
$SQL = qq| $statement |;
warn ("SQL Statement: '$statement'");
$sth = ExecuteQuery($SQL);
[download]

The error log shows: Fri Sep 29 05:59:35 2017 manage_users.cgi: SQL Statement: 'update users set password = 'briddle' where id = '428'' at /home/jalamior/www/httpsdocs/cgi-bin/lib/perl/manageusers.pm line 656.

Thar error log entry shows what the data was.