parameterized queries to prevent sql injection

I haven't created new tests for this change but I checked that some existing tests failed when changing some parameters in these queries (on purpose to test it).