If you are constructing the query yourself (as opposed to some of the above suggestions), you can still use placeholders. Here's a generic format (very similar to the SQL::Abstract approach):

my $sql = "SELECT ... FROM table WHERE 1=1 ";
my @bind;
if( $query{env} ){
  $sql .= " AND upper(env) = upper(?) ";
  push @bind, $query{env};
}
if( $query{component} ){
  $sql .= " AND upper(component) = upper(?) ";
  push @bind, $query{component};
}
...
my $sth = $dbh->prepare($query);
$sth->execute(@bind);
# or use one of the $dbh->selectXXXX($query, {}, @bind)  methods of DB
+I
[download]