Convert to DBO and use prepared statements
Execute the statement, not the DB connection