changed so the connection is provided at execution time, parameters are also substituted into the query at execution time