Sql parameters

Massive, terrible change to bring SQL parameters into play. I think the site works but I've been way too scared to poke too deeply.