You're not quoting any string values. You really really want to take a look at the Placeholders section of the DBI documentation. Currently, you're doing it completely wrong and unsafe.