in reply to variables inside SQL statements

nothing wrong with the previous answers for your precise need. If it weren't paths, perhaps a string like "Where's the beef O'Reilly?" you can also use:

$dbh->quote( "Where's the beef O'Reilly?" );

Originally posted as a Categorized Answer.