DAL Methods now use paramaterized queries

Prevents SQL Injection