It builds an SQL statement headed for a database. And does it in a dangerous way.

• SELECT * is slow, and the order the rows come out is not guarenteed. The rows you want to return should be explicitly named in almost every case.
• Constructs like day = '$d' are dangerous, due to a potential SQL-injection attack. It also negates the use of caching in common cases. Placeholders should be used instead.
• It has a generally poor style. A few newlines and good indentation would make it a lot easier to read.

My suggested style would be:

$sql = qq/
    SELECT * 
    FROM tbl_admin 
    WHERE 
        day = '$d'        AND 
        month = '$m_num'  AND
        year = '$y'       AND 
        expal IN (/ . 
            join(',',keys %expal) . qq/
        ) AND 
        status = '2'/;
[download]

However, note that the above only addresses style issues--the other problems mentioned are not fixed. Further, each programmer is going to have their own style, so I'm sure someone else might format the above in a different way. I am sure, though, that everyone would agree that the above is signficantly better style than the orginal.

In short, do not take this bit of code as anything resembling good coding practice. Judging from the above, I wouldn't trust anything that particular programmer wrote.

For examples of good database practice, I recommend A Short Guide to DBI on perl.com.