deleteFrom() now uses prepared statements