IN () being false could still result in a true result of used in an OR, so instead of just returning, use an always false sql equivalent

web/includes/Object.php

@@ -103,9 +103,8 @@ class ZM_Object {
             $fields[] = '`'.$field.'` IN ('.implode(',', array_map($func, $value)). ')';
             $values += $value;
           } else {
-            return array();
+            $fields[] = '`'.$field'` IN (select top 0 0)'; # evaluates to false
           }
-
         } else {
           $fields[] = '`'.$field.'`=?';
           $values[] = $value;