emailFailReport: don't interpolate values into SQL

The HTML document being embedded can contain single quotes.

Fixes #7208.
databaseFunctions: convert to use SQL parameters

refs #4901