Defensive coding when constructing WHERE clauses

Adds some defensive coding against the possibility of there being empty `WHERE` clauses which would cause the query to fail.

Probably unnecessary, but poka-yoke, y'all!

Also, you don't have to use `prepare()` when you're passing in a static string. Just for variable things.