databaseFunctions: convert to use SQL parameters

refs #4901