my $dbh = DBI->connect( ... );
my $sql = "insert into tbl_name(col_one,col_two) values($val1, $val2)";
my $sth = $dbh->prepare($sql);
$sth->execute();

$sth = $dbh->prepare("insert into tbl_name(col_one,col_two) values(?,?)");
$sth->execute($val1, $val2);

$sql = sprintf "SELECT foo FROM bar WHERE baz = %s",
    $dbh->quote(q("Don't"));

$sql = sprintf "SELECT foo FROM bar WHERE baz = %s",
            $dbh->quote("Don't");

$sql = sprintf "SELECT foo FROM bar WHERE baz = %s",
            $dbh->quote(q("Don't"));

my $dbh = DBI->connect(...);
  my $name_pairs = get_csv_data("data.csv");
  my $sth = $dbh->prepare("INSERT INTO t1 (first_name, last_name) VALUES (?,?)");
  for my $pair (@$name_pairs) {
     unless ($sth->execute(@$pair)) {
         warn($sth->errstr);
     }
  }

# Here, I am confident about the hash keys, less so about the values
   $sql = sprintf("INSERT INTO t1 (%s) VALUES (%s)",
                    join(",", keys(%hash)),
                    join("," map { $dbh-quote($_) } values(%hash))
                  );
   $sth = $dbh->prepare($sql);
   unless ($sth->execute) {
     warn($sth->{Statement});
   }