changed insert query to a prepared statement