bind variables instead of string concatenation

better performance by avoiding hard parses and better security by reducing sql injection possibilities