changed potentially unsafe queries to prepared statements