fix param literal issue, which will embed param string instead of '?' to sql, and cause syntax error