[#54] Use parameters instead of hardcoding quotes

* Instead of building the query using quotes, we can use sql parameters