See DBI placeholders

With most drivers, placeholders can't be used for any element of a statement that would prevent the database server from validating the statement and creating a query execution plan for it.

i.e database names, table names, column names etc. Try

$sql = "GRANT ALL ON $db.* TO ?@? IDENTIFIED BY ?";
$dbh->do($sql, {}, $user, $host, $password);
[download]