parameterize DB queries (#133)