WIP: Replace bad concatenated SQL with happy parameterised SQL.