updates controller queries to use bind params