Fix a security gap, prevent SQL-Injection

Implement PreparedStatements instead of Statements