fixed security issue: prepared statements