corrected sql update with prepared statements