mysql executeQuery uses prepared statement