Hot fix for upload avatar

use `where( ['SQL ?', var] )`