updateTable() now uses prepared statements