Insert variable into sql query