Assuming that you're doing some sort of query-by-example (QBE) form, where the WHERE clause you're generating depends on which form fields have non-empty cells, you can do build a query on-the-fly and use bind parameters by doing something like the following:

As you're scanning your form fields, build an array that holds records (anonymous arrays) of the form   (field, relop, value) where relop defaults to '='. (This scheme allows you to specify things like "> 47".)

You can then scan this array to build the WHERE clause. You have two options here. You could translate directly to   field relop value and then join() these fragments with an AND, or you could translate to   field relop ? (being careful to correctly quote the values) before joining with an AND. Then, prepare() the query. In the later case, you need to scan your array a second time to extract an array of values to pass to execute().

If your application can benefit from caching queries, you can use a concatenation of field names as a key to retrieve a previously-prepared query. E.g., after you construct and prepare a query, save the statement handle using the fields in the WHERE clause as a key.

This scheme can be adjusted to accomodate both IS [NOT] NULL (by decorating the field name as used in the key) and BETWEEN clauses (by repeating the field name).

...
my $form = CGI->new();
my $db_handle = DBI->connect(...);
my @fields = qw(f_1 f_2 f_3 f_4 f_5);
my @query_parts;
foreach my $field (@fields) {
    if ( defined $form->param($field) ) {
        push @query_parts, "$field = " . $db_handle->quote($form->para
+m($field));
    }
}

if ( ! scalar(@query_parts) ) {
    # do something else
    return;
}

my $query = "SELECT * FROM Table_Name WHERE ";
$query .= join " AND ", map { "( $_ )" } @query_parts;
[download]

# I assume the database handler $dbh is already initialized

my $sth = $dbh->prepare("
   SELECT * FROM table 
   WHERE field1 LIKE ?
   AND   field2 LIKE ?
   AND   field3 LIKE ?
   AND   field4 LIKE ?
   AND   field5 LIKE ?
");

for ($field1, $field2, $field3, $field4, $field5) {
   $_ = "" unless defined $_;
   $_ .= "%";
}

$dbh->execute($field1, $field2, $field3, $field4, $field5);

# But please choose better names than $fieldX :-)
[download]

Greetings,
Janek