I pulled the following piece of code from a CGI I wrote a while back:

  my $Cmd;
  if ( $Vars->{ id } == 0 )     #  Insert a new record.
  {
    $Cmd = "insert into fparty (" .
      join(", ",@Fields) . ") values(" .
      join ( ", ", map { "'$Vars->{ $_ }'" } @Fields ) . ")";
  }
  else                          #  Update an existing record.
  {
    $Cmd = "update fparty set " .
      join ( ", ", map { $_='$Vars->{ $_ }'" } @Fields ) . 
      " where id=$Vars->{ id }";
  }
[download]

This piece of code should use placeholders, but it builds the appropriate INSERT or UPDATE based on whether the id number of the object it's working on exists or not.

If you're really stuck with taking the INSERT statement and building an UPDATE statement out of it, you're going to have to parse it somehow -- and it looks like you have some suggestions on how to do that.