I haven't used Win32::ODBC before but here is the best way to solve your problem using DBI.

This is one of my coding rules for secure programs - always use parameters to pass in user input when doing SQL queries. This is the ? in the prepare statement below. You then fill in the blanks when you execute the statement.

my $find_name = $dbh->prepare("select * from table where name = ?");
$find_name->execute($unsafe_name_from _user_via_cgi);
my $row = $find_name->fetchrow_hashref; # or whatever
$find_name->finish;
[download]

The advantage of doing this is that you can have any user input you like in $unsafe_name_from _user_via_cgi and it will never be interpreted as SQL.

You can also re-use the prepared SQL which can make it quicker if you do the same type of query over and over.