Are there any gotchas around the sql parameterization? Looks like you're passing in an array into db.exec. I would have thought that would be enough, but if I search for org-mode then I see an error on the console complaining about no such column: mode.