beware: unsanitized! - TODO: t210114145431 - see https://stackoverflow.com/questions/4333015/does-the-preparedstatement-avoid-sql-injection