Cleaned up the SQL code.

        - sql.Query is now using a param
        - One endpoint to rule them all
        - Multiline string
        - fmt.Fprintf on response writer to avoid string buf