Updating database.py to use parameterized queries instead of string concatenation.

Should be more secure against sql injection.