structure of our sql prepared statements
no sql injection for us, nope nopee