SQL Injection

Added prepared statements