use prepared statements and a more useful/cleaner approach