Use placeholders!!

my $sth = $dbh->prepare("
   INSERT INTO Table (
             foo, bar
          ) VALUES (
             ?, ?
          )
");
$sth->execute($foo, $bar);
[download]

If you can't, use the escape functions the database driver provides!

my @fields = keys(%data);
my $q_fields = join ', ', map $dbh->quote_identifier($_), @fields;
my $q_values = join ', ', map $dbh->quote($_), @data[ @fields ];

my $sth = $dbh->prepare("
   INSERT INTO Table (
             $q_fields
          ) VALUES (
             $q_values
          )
");
$sth->execute();
[download]

Better:

my @fields = keys(%data);
my $q_fields = join ', ', map $dbh->quote_identifier($_), @fields;
my $pholders = join ', ', ('?') x @fields;

my $sth = $dbh->prepare("
   INSERT INTO Table (
             $q_fields
          ) VALUES (
             $pholders
          )
");
$sth->execute(@data[ @fields ]);
[download]