When inserting data into a db you should use $dbh->quote($var) for correct quoting.

Not when using placeholders, as he does now.