Your code:

$clref = $dbh->prepare ("SELECT item_id, color FROM item WHERE prod_id
+ = ".$ref->{product_id});
    $clref->execute();
    
    while (my $color, $item_id = $clref->fetchrow_hashref()
) {
        push @{$ref->{color}, {$ref->{item_id}}, $color->{color}, $ite
+m_id->{item_id};
    }
[download]

has a number of problems. First, you really should always use bind variables with DBI. If you don't, you'll have to escape the variables you put into the SQL yourself in order to prevent big security holes.

Next, while (my $color, $item_id = $clref->fetchrow_hashref() does not make $item_id a lexical ("my") variable. It's a global. If you had use strict and warnings on, it would tell you about that. Also, it's not assigning what you want to $color or $item_id. You're just fetching the hashref that represents a row into $color. I can't really tell what you were trying to do with this code.

Your add_item sub needs to use product_id and color in the SQL statement. Otherwise you will get multiple rows back. It's still doing a "select *" too.