use prepared statements
adds sanitizer