Replaced SQL sprintf's with postgres friendly data bindings.

Second attempt, diff looks OK this time.