It looks like you are trying to use the &foo format for parameters from sqlplus. This will NOT work in perl.

As others have mentioned, use a ? as the placeholder, and pass the parameter in the $sth->execute() call.

Michael