In that case, $form->field contains everything you need and you can ignore @fields. Although a hash is unordered, the keys and values functions are guaranteed to return their elements in the same order. So you can do the following, and be confident that things will match up right:

my $fields = join ', ', keys %{$form->field};
my $values = join ', ', map {$dbh->quote($_)} values %{$form->field};
[download]

However, as Eliya said, placeholders are generally safer than quote(). To use placeholders, you'll need a count of the values:

my $fields = join ', ', keys %{$form->field};
my @values = values %{$form->field};
my $placeholders = join ',', ('?') x @values;
my $sql = qq| INSERT INTO mytable ($fields) VALUES ($placeholders); |;
my $st = $dbh->prepare($sql);
$st->execute(@values);
[download]