prepared statements

changed sql code to use prepared statements in article and user helper
classes