use actual prepared statements

Set PDO attribute emulated prepares to false