Used prepared statements to prevent SQL injection