title: Parameter substitution for a SQLite "IN" clause
body: <p>I am trying to use parameter substitution with <a href="http://docs.python.org/library/sqlite3.html" rel="noreferrer">SQLite within Python</a> for an IN clause.  Here is a complete running example that demonstrates:</p>
  
  <pre><code>import sqlite3
  
  c = sqlite3.connect(":memory:")
  c.execute('CREATE TABLE distro (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT)')
  
  for name in 'Ubuntu Fedora Puppy DSL SuSE'.split():
    c.execute('INSERT INTO distro (name) VALUES (?)', [ name ] )
  
  desired_ids = ["1", "2", "5", "47"]
  result_set = c.execute('SELECT * FROM distro WHERE id IN (%s)' % (", ".join(desired_ids)), ())
  for result in result_set:
    print result
  </code></pre>
  
  <p>It prints out:</p>
  
  <blockquote>
    <p>(1, u'Ubuntu')
    (2, u'Fedora')
    (5, u'SuSE')</p>
  </blockquote>
  
  <p>As the docs state that "[y]ou shouldn’t assemble your query using Python’s string operations because doing so is insecure; it makes your program vulnerable to an SQL injection attack," I am hoping to use parameter substitution.</p>
  
  <p>When I try:</p>
  
  <pre><code>result_set = c.execute('SELECT * FROM distro WHERE id IN (?)', [ (", ".join(desired_ids)) ])
  </code></pre>
  
  <p>I get an empty result set, and when I try:</p>
  
  <pre><code>result_set = c.execute('SELECT * FROM distro WHERE id IN (?)', [ desired_ids ] )
  </code></pre>
  
  <p>I get:</p>
  
  <blockquote>
    <p>InterfaceError: Error binding parameter 0 - probably unsupported type.</p>
  </blockquote>
  
  <p>While I hope that any answer to this simplified problem will work, I would like to point out that the actual query I want to perform is in a doubly-nested subquery.  To wit:</p>
  
  <pre><code>UPDATE dir_x_user SET user_revision = user_attempted_revision 
  WHERE user_id IN 
      (SELECT user_id FROM 
          (SELECT user_id, MAX(revision) FROM users WHERE obfuscated_name IN 
              ("Argl883", "Manf496", "Mook657") GROUP BY user_id
          ) 
      )
  </code></pre>