beginning to make things secure (using php prepared statements)