New where with array to avoid injection