changed 'd' flag in prepared statement to 'i' which is the correct one
prevention of XSS attacks