Where there are joins required to get user fields (e.g. if using a custom profile field in the user identity), core_user\fields::get_sql() returns a JOIN statement padded with spaces at either end. It is documented in code that this "can be appended directly into any existing query without worrying about whether the developer has remembered to add whitespace after it" but if there are no joins the empty string is returned so this doesn't hold.

It may be better if this were to return a space instead of the empty string.

Clearly the client of the API could check whether the joins component was empty before inserting it into their SQL but this is quite at odds with the "don't expect anything of the developer" approach in the comment referenced above, and also the rest of the API.