Use prepared and bind values

use prepare and bind values later to avoid at least issues with names with single quotes and all together avoid sql injection