Placeholders my friend, placeholders

  $sth = $dbh->prepare(
    'SELECT id, title, summary FROM  resource WHERE id = ?'
  );
  $sth->execute($filename);
[download]

Oh yes, and see the docs for more info.

Update: As LTjake has duly noted, placeholders are not the issue here (although they are a must!). You need you to flip the quoting in either the <input> tag or the <TMPL> tag e.g

<input name="search" type="text" value="<TMPL_VAR NAME='SEARCH'>" />

## or 

<input name='search' type='text' value='<TMPL_VAR NAME="SEARCH">' />
[download]

HTH

_________
broquaint