use a stmt and bind parameters for attach so we're not repeating file path and key strings all over