fixing wrong sql query (use of ?)