It looks like the question mark in your first example is being interpolated. Use single quotes instead, like the second example.

UPDATE: oops, ignore my first sentance. Just to save my butt for giving a bad answer, I will say that the second example (using a ? in the SQL statement and then passing arguments to the execute funtion) is better than using double quotes and interpolated any arguments in the SQL statement. The reason is because using the ? in single quotes will allow the SQL statement to be cached once, resulting in a slight performance increase. Example:

'SELECT * FROM FOO WHERE BAR=?'     #this gets used many times

#whereas
"SELECT * FROM FOO WHERE BAR=$val"  #might only get used once
                                    #because different values
                                    #of $val will cause many
                                    #different versions to get
                                    #cached
[download]

Just in case someone reading this didn't know . . .
Jeff