add placeholders to SQL statements