Parameterized SQL, prevents SQL injections
'NULL' is passed as string, must use None
removed json.dumps from strings