Use prepared statements to prevent sql injection

Minimize attack surface by using prepares statements to prevent sql injection.