[Insight] Database queries should use parameter binding