Converted SQL To Parameterized  SQL

Ran my class builder on the database to create parameterized SQL.

Parameterized performs better, is harder to do SQL injection, no Manual
string escaping required.