Now try:

   while ($sth->fetch)
   {
      $username =~ s/\b\Q$badword\b/ **** /gi
        or print "[$badword] not found in $username\n";
      $message =~  s/\b\Q$badword\b/ **** /gi
        or print "[$badword] not found in $message\n";
   }
[download]

The \Q is mostly precautionary, in case $badword might have a regex-special char in it.