Convert db_query to db_select or EntityFieldQuery
Yes, if you're querying entity/field data you should pretty much always use an EntityFieldQuery in place of raw SQL. If you're not querying entity/field data, and need to build up a dynamic query, then db_select() is probably the way to go.

I'd also recommend reading the DB API docs and making sure you understand how to use db_query() properly - currently your code is likely to be susceptible to an SQL injection attack, as you're not using parameterized queries.