parameterized queries to prevent sql injection

I haven't created new tests for this change but I checked that some existing tests failed when changing some parameters in these queries (on purpose to test it).

Don't know why build in Travis is failing: https://travis-ci.org/yosethegame/yosethegame/builds/20015406
I hate to say this, but they're running ok in my machine.