I would say the first one, but with a caveat: not all Database engines/drivers support "prepare". I don't mean it gives an error if you use it, simply it doesn't do anything with it and just waits for the "execute" to start looking at it.

I always tend to use the "prepare" method if only because the parameters passing automatically takes care of all quoting issues (so I almost never use qq{  }).