fix SQL query argument passing