Fix: prepared statement had quotes on params