Without seeing the actual error message generated, only the most general advice can be given:
Use placeholders instead of interpolated values (security and performance)
The 'die' message after both the parse and the execute uses $sql as a reference, when it's clearly initialised as a string.
I think that @remove_dates should be initialised as my @remove_dates = split /\0/,$query->param{remove}; since CGI.pm returns a single string, not an array.