diff --git a/php/oop/database.php b/php/oop/database.php
index 902916e..69afc72 100644
--- a/php/oop/database.php
+++ b/php/oop/database.php
@@ -24,10 +24,10 @@ public function connect_to_database() {
 
 	}
 
-	public function run_query($queryString) {
+	public function run_query($queryString, $params = []) {
 		$output = $this->connection->prepare($queryString);
 	
-		$output->execute();
+		$output->execute($params);
 	}
 }
 
diff --git a/php/oop/user.php b/php/oop/user.php
index 557763a..c73c34b 100644
--- a/php/oop/user.php
+++ b/php/oop/user.php
@@ -64,8 +64,11 @@ public function set_UserEmail($newEmail) {
 		public function save_User() {
 			$this->connect_to_database();
 
-			# not bullet-proof
-			$this->run_query("INSERT INTO users (fname, lname, email) VALUES ('".$this->firstName."', '".$this->lastName"', '".$this->email."')");
+			# bullet-proof using prepared statements
+			$this->run_query(
+				"INSERT INTO users (fname, lname, email) VALUES (?, ?, ?)",
+				[$this->firstName, $this->lastName, $this->email]
+			);
 		}
 	}