Initialize such variables that used in db_query strings

It's a good habit to initialize such variables that have to be used in db_query directly without using a placeholder. However it does not mean direct security threat (discussed with the Security Team), cause it's hard to even install Drupal with register_globals ON - and that would be needed to exploit this, but still, a fix would be nice.