all queries and statements now parameterised
handle null properties