Please Please Please put code tags around that code. It will make it actually readable. Then include enough code that we can actually look for improvements. Never include variables in SQL unless you have to. Use bind variables (the DBI docs have tons on this, use ? in the query and then you supply the data while running the query. I also don't know what exeQuery is but you probably don't need the & in front of it, and i would venture to bet you don't need that function at all.