Added transactional and params to QueryAction

Because "Drunk 'n' Disorderly" is a nice case to remind you of SQL
injection.