Fixed #383 -- Feed the proper SQL to cursor.execute (the one with placeholders).