DatabaseStatements should be real prepared statements

This makes DatabaseStatement completely safe to use for user input,
given that the parameters in the query will be replaced by JDBC based on
the connection type, and parameters and encoding of the database
connection.