use prepared statement instead of string interpolation