preparing your "updating" statement with placeholders