If the user enters `system -rf /` into your program or Robert'); DROP TABLE Students; --, you will get problems, depending on how exactly you're accepting the user input. You most likely want to read up on DBI place holders. eval is the wrong tool for this.

If you need to dynamically construct a query with varying expressions, you should still use DBI placeholders instead of trying to use eval or string interpolation or string concatenation.