SQL queries now use ? and param list