From the DBI pod:

The "do()" method can be used for non repeated non-"SELECT" statement (or with drivers that don't support placeholders):

$rows_affected = $dbh->do("UPDATE your_table SET foo = foo + 1");

As a pragmatic solution, I'd go with $dbh->do() rather than $sth = $dbh->prepare(); $sth->execute() to avoid having to write a patch ;-)

...but then, input sanitizing would rest heavily on my own shoulders...

update - uhm, scratch that, note the 'non-"SELECT" statement' above :-(

update 2: thinking about it again - the best solution is to grab a LART and make that user rename the columns.