Properly use PreparedStatement