changed limit and offset to bound variables using a prepared statement
added input filters to sanitize and format post data