use PDO instead of msqli