Remove string concatenation in SQL statements

[tessereth]

There probably aren't any SQL injections here. But we should fix it anyway.

[tessereth]

This may not be possible. Most (if not all) of the places that have string concatination won't actually work with placeholder arguments. This card should possibly change to "Make sure all arguments added to an sql query are checked against a good regex first".

[aeijdenberg]

While placeholder arguments won't work in all cases, there are often alternatives for identifiers, such as https://godoc.org/github.com/lib/pq#QuoteIdentifier for Postgres. Assigning to self to fix.