add some SQL convenience functions

combine query composition and DB calls, with proper escaping
for all SQL parameters