Increased SQL query security

Changed to prepared statements to avoid SQL injection.