Fix query parameterization

[g-tom]

Queries should be parameterized using setParameter and not using string concatenation.

At least DatabaseBasisQuery and friends are heavily affected.