fixed SQL statement bugs, was not accessing params