CC-5121: fix some SQL statements not being escaped/prepared