PDO: prepared statement is used instead of direct execute.