all interations with database now using ParameterizedStatements