CVE-2012-2695 Fix SQL injection via nested hashes in conditions

(adapted from commit by [Justin Collins])
CVE-2012-5664 options hashes should only be extracted if there are extra parameters

(adapted from commit by [Aaron Patterson])