prepared statements and sql injection protection

protects database_interface