using preparedStatement instead