Pass arguments to where to prevent SQL injection