Use prepared statements or turn raw SQL into SQLAlchemy to avoid injection exploits

[marcua]

Updated description since @thisisdhaas pointed out: why not implement more of the raw SQL as SQLAlchemy?