Yes, definitely use placeholders. There's some documentation on the DBI page, but it's really quite simple:

# BAD!
$dbh->do("
   INSERT INTO Table (
             a,
             b,
             c,
          ) VALUES (
             '$fields[0]',
             '$fields[1]',
             '$fields[2]'
          )
");
[download]

and

# BAD!
my $sth = $dbh->prepare("
   INSERT INTO Table (
             a,
             b,
             c,
          ) VALUES (
             '$fields[0]',
             '$fields[1]',
             '$fields[2]'
          )
");

$sth->execute();
[download]

become

$dbh->do(
   ("
      INSERT INTO Table (
                a,
                b,
                c,
             ) VALUES (
                ?,?,?
             )
   "),
   undef,
   @fields,
);
[download]

or

my $sth = $dbh->prepare("
   INSERT INTO Table (
             a,
             b,
             c,
          ) VALUES (
             ?,?,?
          )
");

$sth->execute(@fields);
[download]