changed insert to use sql parameters
made update use sql parameters as well