parameterize sql statements

parameterize all the sql concats


(but ConfigNode seems to be missing/broken idk what happened after pull from upstream)
Hope it doesn't break anything.