how to make a parametrized query