prepare statement in case there exists attack