always use prepare statement :)