modifies sql query and uses a prepared statement to pull results into a form. sends id with hidden input