changed to use prepared statements