adding parameter bindings to tx.executeSql + updated INSERT INTO to use parameter bindings