chang to prepared statement & function