If your intention is to parse SQL, see http://search.cpan.org/~rehsack/SQL-Statement-1.412/lib/SQL/Parser.pm.

We just had a discussion about how to (not) parse strings with embedded quotes, it's not trivial Re^4: Parser Performance Question (updated).

Anyway I strongly support haukex' comment to use SQL-placeholders, anything else is insane.