To expand on the other answers. The placeholder is just the ? character, you can't use something like the '%?%' because the DBI interprets that to be a literal query string. To build the query string use the ? in the placeholder and replace it with your concatenated string in the execute.

You might also want to look at the database section of the tutorials on this site.

jdtoronto