Updated SQL queries ensuring all parameters are escaped.