refactoring, use of parameterized queries