You are interpolating into a string and then using that string as a sprintf template. You are also not using placeholders, nor quoting things that go directly into the SQL.

Consider the following things that can go wrong when generating your SQL:

• The first character of $search is right next to a "%" character. So by putting in a character that sprintf recognizes, you can "steal" the number meant for the LIMIT clause.

  my $search = "foobar";
  printf "WHERE blah LIKE '%$search%' LIMIT %d,%d\n", 1, 2;
  
  # ... LIKE '%foobar' ...
  #           ^^
  
  # WHERE blah LIKE '1.000000oobar%' LIMIT 2,0
  [download]

• Steal both numbers meant for the LIMIT clause, since "%" symbols in $search are not escaped

  my $search = "f %d";
  printf "WHERE blah LIKE '%$search%' LIMIT %d,%d\n", 1, 2;
  
  # WHERE blah LIKE '1.000000 2%' LIMIT 0,0
  [download]

• Other special symbols are not escaped, and directly included in the SQL:

  my $search = "' OR '1' LIKE '1";
  printf "WHERE blah LIKE '%$search%' LIMIT %d,%d\n", 1, 2;
  
  # WHERE blah LIKE '%' OR '1' LIKE '1%' LIMIT 1,2
  [download]

You can even do nastier stuff with a sprintf injection attack -- like change the value of variables in the script! So it is not just the SQL statement or database that might be affected.

Solutions/suggestions:

• use DBI placeholders for inserting user-supplied data into the SQL statement (for automatic escaping of SQL special chars).
• Don't directly interpolate user-supplied data into a s/printf statement (to avoid sprintf injection).
• Don't use s/printf when you have "%" characters all over the SQL statement (it's not clear whether the "%" chars of the SQL statement will be eaten up by s/printf or not).