I'm getting "Call to undefined function where()"

I haven't tried this yet, mainly because my site has been misbehaving in a very bad way:

I'm getting only getting empty strings responses back in the httpResponse.responseText member most of the day, and only a few times am I getting anything else, this in spite of the fact that I've not changed the way my page communicates with the server.  Really odd, is that when I was on the phone with my host provider about this, I suddenly started getting responses, but the tech-support guy at the host provider, looking at the same page I was on, wasn't getting only getting empty responses.

In an effort to track this problem down, I captured the headers, and noticed that I was getting a length of 22 when I do get data, but 20 when I don't.  I don't know what this means, but it does show something different.  There are no errors or status differences other than the 22 vs 20 length is indicated.

Anyway, back to the issue of this thread, in my query, now stuffed with the entire select statement into the select function, if I use ? as place holders for value substitution, will they be substituted or do I need to use some other preprocessing step before using the query command?

Also, I read somewhere that the substitution that MySQLi used versus PDO or other databases, was lacking with regards to security compared to those other databases.  Is this true?  Is there something that I need do to do to prevent 'hackers' from hijacking my SQL Select queries?

Thanks again