my $sql = "SELECT * FROM user WHERE user = '$user'";
my $sth = $dbh->prepare($sql);
$sth->execute()