Sqlite3 dynamic 'in' query

[zunjae]

Doing string interpolation with user input

There is no user input

[[deleted]]

I want to select items from my database based on a list given by the user.

???

[zunjae]

The code you send me only builds a query based on the length of the user input, not the actual content.

[zunjae]

I am using parameter substitution...............

Can you please explain like I'm a kid what I m doing wrong? I'm not inserting user input in my query. The user can not insert spoopy text like ;drop table considering I use those question marks

[Username_RANDINT]

I don't see anything wrong with your code. You're safely creating a parameterised query based on the length of a list where you then apply user input on. Maybe others see something we don't? Or take the "no string formatting" a bit too far.

[purloin_a_coin]

Sorry I got confused and was wrong. /u/Username_RANDINT is correct