change db.query to prepared statement