CC-5121 : fix some SQL statements not being escaped/prepared