Pass variables properly into bindParam()