Use prepared statements for security