Use proper paramterization and escaping of SQL query conditions

Change-Id: I27d67277eb56a8b4c895ac153728a592f050630b