changed to prepared sql statements to protect against SQL-injection