reworked entire file, to use prepared statements