title: Is addInCondition() method in CDbCriteria "SQL-injection proof"?
body: <p>I wanna use CDbCriteira addInCondition() for multiple input parameters (number is not predefined). Does this method compose parametrized query or not?
  I found controversial thoughts on this:</p>
  
  <ol>
  <li><a href="http://www.yiiframework.com/forum/index.php/topic/13119-sql-injection-question/page__view__findpost__p__122789" rel="nofollow">yes</a>  - "Since it uses CDbCriteria I would assume it to be safe" - quote.</li>
  <li><a href="http://www.yiiframework.com/forum/index.php/topic/24243-security-mysq-injection/page__view__findpost__p__117662" rel="nofollow">no</a></li>
  </ol>
  
  <p>Also I've looked at <a href="https://github.com/yiisoft/yii/blob/1.1.15/framework/db/schema/CDbCriteria.php#L274" rel="nofollow">the addInCondition() method specification</a> and i couldn't get clear though.</p>