changed SQL to take params