using prepared statements + added email for users