insertInto() now uses prepared statements