You cannot have a fieldname represented by a "?" placeholder (unless you use some trickery as Anonymous Monk said). The prepare method of DBI asks the database to look at the SQL before it is executed and already prepare an execution plan.

Not knowing the fields to use at the moment of preparing the statement handle will not allow the database to prepare a plan, hence the error.

One more comment: having both RaiseError on and using die statements is overkill.

From the docs:

The RaiseError attribute can be used to force errors to raise exceptions rather than simply return error codes in the normal way. It is "off" by default. When set "on", any method which results in an error will cause the DBI to effectively do a die("$class $method failed: $DBI::errstr"), where $class is the driver class and $method is the name of the method that failed.