Care Pathways reports

http://manage.dimagi.com/default.asp?124276
It's hard to tell where all these parameters are coming from, but again, this is vulnerable to SQL injection. The safest way to do it is to use a bind parameter. Also, if `fil.parameter` is ever a string this will likely not work.