parameterized queries in createPlayer to prevent sql injection