migrated over to prepared statements