Use PreparedStatements instead of raw sql (to avoid SQL injection)