Some work in avoiding sql injections: need to change every Queries with
user provided data with prepared statements