my $statement = qq{
  SELECT *
    FROM onshelf
   WHERE $search LIKE ?
};

my $sth = $dbh->prepare($statement);
$sth->execute("%$criteria%");