Unrelated to the problem you're asking about, please read the DBI documentation for Placeholders and bind variables. SQL_injection has more information on the subject.