started refactoring to use only prepared statements w/ PDO