use sprintf instead of ->prepare which dealing with comma'd ID lists

git-svn-id: https://plugins.svn.wordpress.org/wp-featured-content/trunk@783556 b8457f37-d9ea-0310-8a92-e5e31aec5664