JZed's response is correct -- use placeholders (best way) or you're required to obey SQL syntax and single quote the values. Just an additional tip, though -- a simple debugging statement like this:

my $uname = 'leander@whatever.com';
my $sql = 'SELECT uname, pwd FROM login WHERE uname=' . $uname;
warn $sql; # <====== would print:
           # SELECT uname, pwd FROM login WHERE uname=leander@whatever
+.com
           # which is illegal SQL
my $res = $dbh->selectall_arrayref($sql) || die $dbh->errstr;
[download]

would (could/should) of pointed the problem out as well.