use paramaterized queries to provide barrier to sql injection attacks