Use prepared statements to securely pass values to queries