change the sql varable to ? intead of