parameterize sql statements
Merge pull request #249 from Wayneoween/master

parameterize sql statements