Use db_param to supply in all parameters

I'll work out a patch to handle that within db_query_bound() in a second - there's already some code in db_query_bound that attempts to do similar for output when logging.