modify sql statement using prepare statement