This is a common mistake, but don't be tempted to commit it. While it's easier to add your own quotes, you're bound to run into trouble when the string you're quoting has quotes of it's own. While an accidental inclusion of a stray quote will probably only break your script, a malicious user could attempt to modify your query to get information you never intended to be public. Also, quoting mechanisms are different across databases. What works on the platform you're developing with may not work with another when you need to change down the road. The DBI quote method always properly quotes strings by respecting the particular database's conventions for escaping metacharacters and enclosing quoted strings. Placeholders automatically use DBI quotes and make like easier in the long run, so you're much better off using them.