Converting count operation to use SQL prepared statements

This helps protect against SQL injection attacks.