In that case, $form->field contains everything you need and you can ignore @fields. Although a hash is unordered, the keys and values functions are guaranteed to return their elements in the same order. So you can do the following, and be confident that things will match up right:

my $fields = join ', ', keys %{$form->field};
my $values = join ', ', map {$dbh->quote($_)} values %{$form->field};
[download]

However, as Eliya said, placeholders are generally safer than quote(). To use placeholders, you'll need a count of the values:

my $fields = join ', ', keys %{$form->field};
my @values = values %{$form->field};
my $placeholders = join ',', ('?') x @values;
my $sql = qq| INSERT INTO mytable ($fields) VALUES ($placeholders); |;
my $st = $dbh->prepare($sql);
$st->execute(@values);
[download]

Thanks to you both. Had tried with placeholders but was getting the whole $form->field part mixed up so I simplified things. But Aaron's solution worked so thank you.

Yes, but if you use @fields to create your list of column names ($dbfieldlist) for the insert statement, the corresponding values should match, shouldn't they?  And hashes have no defined ordering.  In other words, if you take the keys from the hash, you'd have to make sure that you sort them appropriately.  So why not take @fields directly — I'd suppose it contains the same names as keys %$fields anyway, only in (presumably) different ordering.

my @fields = qw(foo bar baz);

# create a hash (as returned by $form->field)
my $fields = { map { $_ => "val_$_" } @fields };

my  $dbfieldlist = join ", ", @fields;
my  $dbfielddata = join ", ", map { "'$fields->{$_}'" } keys %$fields;
+  # wrong ordering
#my $dbfielddata = join ", ", map { "'$fields->{$_}'" } @fields;      
+  # ok

print "INSERT into DBTABLE ($dbfieldlist) VALUES ($dbfielddata)";

#      INSERT into DBTABLE (foo, bar, baz) VALUES ('val_bar', 'val_baz
+', 'val_foo')
[download]