use prepared statements for insert

Signed-off-by: Arvid E. Picciani <aep@exys.org>