db_query in, use db_placeholder