bind variables in sql query

better protection from sql injection and a tiny bit less load on mysql by avoiding hard parses