Fixed prepared statements so no SQL injection will be possible.