You are not escaping some meta characters in your $var. Do a  $var = $dbh->quote($var); before you build the SQL. See my earlier post.