title: "SELECT ... WHERE ... IN" with unknown number of parameters
body: <p>I'm attempting to perform a query in the form of...</p>
  
  <pre><code>SELECT col2 FROM tab WHERE col1 IN (val1, val2, val3...)
  </code></pre>
  
  <p>...where the values are stored in a Python list/tuple of arbitrary length. I can't seem to find a "clean" way to do it.</p>
  
  <pre><code>&gt;&gt;&gt; db = connect(":memory:")
  &gt;&gt;&gt; db.execute("CREATE TABLE tab (col1 INTEGER, col2 TEXT)")
  &gt;&gt;&gt; db.execute("INSERT INTO tab VALUES(1,'one')")
  &gt;&gt;&gt; db.execute("INSERT INTO tab VALUES(2,'two')")
  &gt;&gt;&gt; db.execute("INSERT INTO tab VALUES(3,'three')")
  &gt;&gt;&gt; db.execute("INSERT INTO tab VALUES(4,'four')")
  &gt;&gt;&gt; db.execute("INSERT INTO tab VALUES(5,'five')")
  &gt;&gt;&gt; db.commit()
  
  # Expected result
  &gt;&gt;&gt; db.execute("SELECT col2 FROM tab WHERE col1 IN (1,3,4)").fetchall()
  [(u'one',), (u'three',), (u'four',)]
  
  &gt;&gt;&gt; vals = (1,3,4)
  
  &gt;&gt;&gt; db.execute("SELECT col2 FROM tab WHERE col1 IN (?)", vals).fetchall()
  Traceback (most recent call last):
    File "&lt;stdin&gt;", line 1, in &lt;module&gt;
  sqlite3.ProgrammingError: Incorrect number of bindings supplied. The current statement uses 1, and there are 3 supplied.
  
  &gt;&gt;&gt; db.execute("SELECT col2 FROM tab WHERE col1 IN (?)", (vals,)).fetchall()
  Traceback (most recent call last):
    File "&lt;stdin&gt;", line 1, in &lt;module&gt;
  sqlite3.InterfaceError: Error binding parameter 0 - probably unsupported type.
  
  &gt;&gt;&gt; db.execute("SELECT col2 FROM tab WHERE col1 IN (?)", (','.join(str(val) for val in vals),)).fetchall()
  []
  
  &gt;&gt;&gt; 
  </code></pre>
  
  <p>Now I can do the following, which (I think... please correct me if I'm wrong) retains the security of the built-in parameter substitution, but it's still a bit ugly:</p>
  
  <pre><code>&gt;&gt;&gt; db.execute("SELECT col2 FROM tab WHERE col1 IN (" + ",".join("?"*len(vals)) + ")", vals).fetchall()
  [(u'one',), (u'three',), (u'four',)]
  &gt;&gt;&gt; 
  </code></pre>
  
  <p>Is that my best option, or is there a nicer way around this?</p>