all queries made into prepared statements
change to json