Change couple queries to use prepared statements