bind sql parameters for our prepared statements