added $wpdb->prepare to queries