$sth->execute($username); ... DBI should escape the underscore in the code above, correct?

No, not correct. Neither DBI nor Pg should automatically escape underscores since there's no way for them to know when you mean a literal underscore and when you mean a wildcard. It sounds like you've had a frustrating time, my condolences, I've been there. But I usually find that when I start thinking "module Foo really sucks" where Foo is a widely used and heavily supported project like DBI or Pg, it's usually turns out to be more a reflection of my frustration level than of the project. Hope it all works out for you.