Try

my $sql = "SELECT * FROM users WHERE id = ?";

my $statement = $db_handle->prepare($sql)
        or die "Couldn't prepare query '$sql': $DBI::errstr\n";

$statement->execute($user)
        or die "Couldn't execute query '$sql': $DBI::errstr\n";
[download]

If you really want to have $user in a string then you can add

$user ||= '';
[download]

In your code before you use it.