Update raw SQL queries to use SQLAlchemy

[dadmobile]

This has bitten us now that we are trying to support both SQLite and Postgres. For example, we have a table called user which is a reserved keyword in Postgres and if you don't handle that properly it acts very surprisingly!