If you add the line

  DBI->trace(2, '/path/to/trace_output');
[download]

...somewhere before the errant call, you'll be able to see the actual SQL that DBI sent to MySQL, with all bind-parameters substituted. If you cut and paste that exact output into mysql command line and don't get a syntax error, then very odd things are afoot! Like the others, I have a feeling there's some quoting or variable substitution problem happening that you might not notice until seeing the final SQL result.

Update: see also DBI's pod

blokhead