Changed Queries to PreparedStatements

we don't want any nasty injections