fix query to use prepared statements