using parameterized query to do safe mysql quote

fix datareader exists, by closing it first