added some prepared statements
fixed single quote SQL escaping function