my $col_string = '';
for my $var ( sort {$$href{$a} <=> $$href{$b}} keys %$href ) {
    $col_string .= "$var,";
}
chop $col_string;  # remove final comma
[download]

I always view the chopping of a trailing comma in building an SQL statement as something of a Red Flag. It usually means that a join (in the Perl sense) is called for. For instance, the above snippet is better written as

my $col_string = join( ',',
    sort {$href->{$a} <=> $href->{$b}} keys %$href
);
[download]