Most SQL queries now use prepared statements