use stmt instead of mysqli_query
 part fo passwd reset