move prepared statement into dao method so we can Close() it