You might have more luck doing

$sth = $dbh->prepare(
    "insert into $tblname (product_id, model_number, description)
     values (?, ?, ?)");
    $sth->execute($prod_id, $mod_num, $data);
[download]

Arguments to execute() are quoted implicitly.