a tad more security for query, update, and insert

several query methods now have dedicated AIR/PHP commands instead of
using Query. @todo trackback and remove any AIR command that still uses
the query command, then remove the query command from the API entirely