updated to use prepared statements