title: imploding a list for use in a python MySQLDB IN clause
body: <p>I know how to map a list to a string:</p>
  
  <pre><code>foostring = ",".join( map(str, list_of_ids) )
  </code></pre>
  
  <p>And I know that I can use the following to get that string into an IN clause:</p>
  
  <pre><code>cursor.execute("DELETE FROM foo.bar WHERE baz IN ('%s')" % (foostring))
  </code></pre>
  
  <p>What I need is to accomplish the same thing SAFELY (avoiding SQL injection) using MySQLDB. In the above example because foostring is not passed as an argument to execute, it is vulnerable. I also have to quote and escape outside of the mysql library. </p>
  
  <p>(There is a <a href="https://stackoverflow.com/questions/315672/automagically-expanding-a-python-list-with-formatted-output">related SO question</a>, but the answers listed there either do not work for MySQLDB or are vulnerable to SQL injection.)</p>