Updated query() to accept parameters

The query() method required debs to manually escape strings secure SQL
statements. Query has been updated to allow a second (optional)
argument which is passed to PDO (as a parameter) and is sanitized
through PDO. This update should not negatively affect existing
applications using the query() method.

Addresses issue #157 I posted.