updated to use pdo prepared statements