Modify all sqlite queries to use bound parameters

[kevinbentley]

Right now everything uses a format string, which is susceptible to sql injection. Since we control the parameters this is a very low risk, if a risk at all. But it's not the correct way to do this, and someone reviewing the code may see this as an issue