Better parameter escaping, including escaping ? for older PHP::PDO.