fixed SQL to use prepared statements