Updating comments
Parameterized queries

- Changed all queries (and DB query function) to use parameterized
variant of pg's client.query method, preventing SQL injection and errors
from escaped values