completed change to PDO and prepared statements