As davorg points out, your immediate problem is that your quoting is screwed up.

However, there are couple of other things I'll point out - which you can either take on board, or ignore completely ;)

Update: As has been pointed out below, placeholders are not appropriate for column names (which don't need to be quoted anyway). Have updated my example accordingly.

1. It's best to try and avoid "SELECT *", and instead explicitly select the columns that you need. You never know when somebody might come along and add a few colums without you knowing.

2. Use placeholders!! Especially in CGI scripts, which this one obviously is. Instead of the code you have above, write something like:

   my $name = param('name');
   my $sth = $dbh->prepare("SELECT foo, bar FROM $pictures_table WHERE st
   +ats = ? AND poster_name = ?");
   $dbh->execute(2, $name);
   [download]

   The above is not only much more robust and secure, it also removes the need to worry about quoting stuff - as this is automagically taken care of by the DBI.

Cheers,
Darren :)