update users set password_question = :password_question, password_answer = :password_answer where user_id = :user_id