<p>What is the preferred way to insert strings that can contain both single and double quotes (",') into MySql using DBI?  For example, <code>$val1</code> and <code>$val2</code> can contain quotes:</p>

<pre><code>my $dbh = DBI-&gt;connect( ... );
my $sql = "insert into tbl_name(col_one,col_two) values($val1, $val2)";
my $sth = $dbh-&gt;prepare($sql);
$sth-&gt;execute();
</code></pre>

Use a bound query using
```
```
$sth = $dbh->prepare("insert into tbl_name(col_one,col_two) values(?,?)");
$sth->execute($val1, $val2);
```
```
If you use bound variables, everything is escaped for you.
Update: Changed my example to correspond with the example edited into the question.
Update: I don't know why Adam deleted his answer, but if for some reason you can't use bound variables (aka "placeholders"), you can also use
```
$dbh->quote($var)
```
on the variable.  For example:
```
```
$sql = sprintf "SELECT foo FROM bar WHERE baz = %s",
    $dbh->quote(q("Don't"));
```
```