handle empty criteria without exploding because we're only ever going to shove this in as WHERE %s because lazy