XSS Stuff and prepared statements