You're skipping a very important step. Once you've assembled $up, print it out and inspect it by eyeball. Even if you can't see where your code is producing syntactically invalid SQL, you've still reduced the problem by taking Perl out of the mix.

Maybe you did that, but your question doesn't suggest that is so. In particular, you didn't show us an assembled SQL query that demonstrates the problem.