added prepare statements for sql injection