Change to use prepared statement

[mlindholm]

Seems this is not called anywhere, but just to be safe side changed it from raw sql select string to prepared stament.