Forgot to set parameters to prepared statement, duh.