Ouch. Don't do that.

What if the $fname value contains a quote? Or some other "special" character you haven't thought of yet?

Use placeholders (or use $dbh->quote if placeholders are underpowered).

see this section of the DBI docs for starters