Hacker News Reader

Yes, it will interpolate. The DBI package he's using does support parameter bindings with a ? character. He's just doing it wrong.

This is a classic SQL injection bug/security flaw

Ironic since I always thought one of the coolest features in perl was taint analysis, which allows keeping track of all unparsed user input:

No, Perl strings are interpolated at creation.