There are a couple of things that I would recommend:

1. First, when posting code in your question, please wrap it in <code> ... </code> tags, so that it is easier to read.
2. Second, it is generally a best practice to use placeholders in your query, and pass the values as arguments.

See What are placeholders in DBI, and why would I want to use them? for more information about placeholders.