I think we should inject `$db` into make_sql_where() directly, as you don't need a db for all other methods