Add prepare statement to SQL query