This needs to use a prepared sql statement