Helper method to encapsulate SQL injection safe "WHERE __ in (...)" clauses with Python's MySQLdb driver. An amalgamation from this SO post: http://stackoverflow.com/questions/589284/imploding-a-list-for-use-in-a-python-mysqldb-in-clause

safe_sql_where_in_clause_interpolation.py

def safe_sql(sql, *values):
   assert sql.count('%s') == len(values), (sql, values)
   placeholders, new_values = [], []
   for value in values:
      if isinstance(value, (list, tuple, set)):
         placeholders.append(', '.join(['%s'] * len(value)))
         new_values.extend(value)
      else:
         placeholders.append('%s')
         new_values.append(value)
   return sql % tuple(placeholders), tuple(new_values)

ids = [1,2,3,4,5]
some_col = 17
SQL = "SELECT * FROM tbl WHERE id IN (%s) and some_col = %s"
# ('SELECT * FROM tbl WHERE id IN (%s, %s, %s, %s, %s) and some_col = %s', (1, 2, 3, 4, 5, 17))

... cursor.execute(safe_sql(SQL, ids, some_col))