added host variables (terribly incomplete) logic
this is the SQLi-safe way to pass user values