The current return db_query($sql, array_merge($where_string, $where_values)); is not working well.

I suggest replacing it with

return db_query($sql, $where_values);