I am reviewing a Linux based perl web application that contains a login handler with the ubiquitous
my $sth = $DB->prepare(\"SELECT password from passwords where use
It might be difficult, if not impossible, to have a generic sanitizer against SQL injections.
Added [As commented, using the DBI correctly and with the help of the DB's client library, the injections can certainly be minimized with respect to preparing the SQL statement. However, it's important to keep in mind that sanitizing user input also involves application logic which is independent of the DB used. For example, using another user's credentials may provide a valid and safe statement, but with unintended consequences. Anyway, that's going further than the question asked.]
Removed [You're better off sanitizing the input yourself rather than having any sense of false security on the client's resistance to these types of attacks. Not that you shouldn't use them, just don't assume they provide more than minimal help against the attacks.]