update: change Statement to preparedStatement (performance and
security[SQL INJECTION]), new SQL STRING to work on preparedStatement