Fix binding of SQL query params in DB utils.

We should not rely on string.format() or % string formatting
when binding params of SQL queries. This particular case is
trivial and the input is completely controlled by a developer,
but we should always be pedantic to encourage good coding practices.

Change-Id: I3c44aa722681e3b80e95641a296e7e1f1a463a8a
Merge "Fix binding of SQL query params in DB utils."