shouldn't you use a prepared statement?