Update stats.py

SQLite which uses ? as the param style, which we need to use when dynamically building our values list for our insert statement.  I'll test with Postgres and MySQL; trying to avoid adding conditional statements for database types.  Moved config variable globally as _config.