string substitution for SQL call