$sth->execute($var) replaces the first placeholder with the contents of $var, taking care of proper escaping, and thus preventing SQL injection. Consider

$filename = "random.jpg'; drop table FanRatings; select 2 * 5,'";
$sth = $dbh -> prepare (
    qq~select One, Two, Three from FanRatings where Title = '$filename
+'~
) or die $DBI::errstr;
$sth->execute;
[download]

Oops, table FanRatings gone, and 10 and the empty string returned...

Whereas with placeholders, the embedded quotings in $filename will be escaped as the current database driver requires.

_($_=" "x(1<<5)."?\n".q·/)Oo.  G°\        /
                              /\_¯/(q    /
----------------------------  \__(m.====·.(_("always off the crowd"))."·
");sub _{s./.($e="'Itrs `mnsgdq Gdbj O`qkdq")=~y/"-y/#-z/;$e.e && print}