Updated SQL statement with Placeholders.

The SQL statement is vulnerable to SQL injection attack and now has been replaced by placeholders to enable safety. 

E-mail added for feedback