fixed up some stuff in dml around quoting of identifiers and added prepared statements to execute_sql