changed to prepared statements