Um, you are using DBI's placeholders, right? Because if you're passing user data into those variables, you're leaving yourself wide open for SQL injection attacks...