Change MySQL query to prepared statement