now using placeholders in sql