Corrected use of parameterised sql