Added prepare statement to prevent SQL injection