I think these first two placeholders are meant to be field names in the sql, so they should be quoted here?  Then the last two are the values?