Added the params attribute for all queries

Doing this will defeat SQL injection, all public facing SQL vars need
to be passed along as cfqueryparams