consistent use of preparedstatement to set sql query parameters