changed statements to prepared statements