prepared statements for all except upload.php, userprofile.php and verify.php