sql paramaters instead of string formatting