Side comment: The query uses dynamic SQL in that it includes a variable for the username inside the SQL statement. Perhaps you can replace the variable with a placeholder, and pass the variable when executing the statement. With the prepare() there you're already half way.