Your user could provide the string user' OR 1 --, which means that the query always returns all rows in the table.

A better protection is the usage of placeholders, as demonstrated in the DBI documentation:

my $query = $dbh->prepare(= "select name, pass from unpw where name = 
+?");
# no checking needed here:
$query->execute($entered_un);
[download]