correct sql to use IN!