Here is my solution using placeholders. I added framing code to make it easier for other monks to test; all you need is SQLite, the cross-platform DB in a single executable.

Working, tested code:

#!/usr/bin/perl
use strict;
use warnings;
use DBI;

my $username    = 'xxxxxx';
my $password    = 'xxxxxx';
my $host        = 'localhost';
my $database    = 'xxxxxx_innoTest';
my $tableName   = 'members';

my $data_source = "DBI:mysql:database=$database;host=$host";

# Overriding for local testing with SQLite.
my $db_file = 'pm790190.sqlite';
sub sqlite {  system( sqlite3 => '-line', $db_file, @_ )==0 or warn; }
{
    unlink $db_file if -e $db_file;
    sqlite(<<'END_OF_SQL');
        CREATE TABLE members (
            nameLogin char(50),
            password  char( 8),
            nameFirst char(20),
            nameLast  char(20),
            email     char(30)
        );
END_OF_SQL
    $data_source = "dbi:SQLite:dbname=$db_file";
}

my %memberRecord = (
    nameLogin => 'testloginname; DROP TABLE members;',
    password  => 'testpwd',
    nameFirst => 'testfirstname',
    nameLast  => 'testlastname',
    email     => 'testemail@mycompany.com',
);

my @column_names  = sort keys %memberRecord;
my @column_values = map { $memberRecord{$_} } @column_names;
my @placeholders  = map { '?'               } @column_names;

my $column_name_list = join ', ', @column_names;
my $placeholder_list = join ', ', @placeholders;
my $sqlStatement = <<"END_OF_SQL";
    INSERT
    INTO     $tableName
            ($column_name_list)
    VALUES  ($placeholder_list)
END_OF_SQL

my $dbh = DBI->connect( $data_source, $username, $password )
    or die $DBI::errstr;

my $sth = $dbh->prepare( $sqlStatement )
    or die $dbh->errstr;

$sth->execute(@column_values)
    or die $dbh->errstr;

$sth->finish();
undef $sth;

$dbh->disconnect()
    or warn "Disconnection failed: $DBI::errstr\n";

# Checking results of local testing with SQLite.
sqlite('SELECT * FROM members');

[download]
Output:
    nameLogin = testloginname; DROP TABLE members;
     password = testpwd
    nameFirst = testfirstname
     nameLast = testlastname
        email = testemail@mycompany.com

[download]

In reply to Re: drawbacks to 'eval' parameters/placeholders/binding in DBI calls to mysql database by Util
in thread drawbacks to 'eval' parameters/placeholders/binding in DBI calls to mysql database by nextguru

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.