no more injection

Fixed sql injection problem by parameterizing queries. Required much
reworking of the methods involved.