To elaborate on this point, if you use placeholders your code will look like this:

select something
from   sometable
where  foo = ? 
and    bar = ?
[download]

You would then prepare the statement as normal, but when executing, your execute clause will look like:$sth->execute(@bindvar); nice and simple.. :-)