use prepare for protecting from sql injection