projects.php converted to prepared statements