don't use prepare for static SQL strings