use sql bind variables to avoid injections problems
Merge pull request #5 from Remo/sql-binds

use sql bind variables to avoid injection problems