fixed and added a sql injection prepare