Hi,
you can call  $dbh->quote($var_name) this method before executing the query.
.This method will take care of the special characters.

more info:
http://search.cpan.org/~timb/DBI-1.48/DBI.pm#quote_identifier