use prepared statements in util_mysql