Slowly switching to prepared statements

As cool as the custom query function was, it's still really vulnerable
to SQL injections.