Use binding where possible in sql statements