Can you explain where you are getting $fd from? I'm assuming you're using the Vars method of CGI, but it would be good to be explicit about it.

As to your qestion, I might consider doing this by naming all of your checkboxes the same thing, thus receiving an arrayref back to start with:

<input type="checkbox" name="chk" value="foo" onclick="sql()" />
<input type="checkbox" name="chk" value="bar" onclick="sql()" />
<input type="checkbox" name="chk" value="baz" onclick="sql()" />
[download]

Then you can:

my $columns = join ','              # join with commas
              map { $db->quote($_) } # quote everything
              @{$fd{chk}};          # dereference the arrayref
[download]

perl -e 'split//,q{john hurl, pest caretaker}and(map{print @_[$_]}(joi
+n(q{},map{sprintf(qq{%010u},$_)}(2**2*307*4993,5*101*641*5261,7*59*79
+*36997,13*17*71*45131,3**2*67*89*167*181))=~/\d{2}/g));'
[download]