Added prepare statements to prevent sql injection