Add sanitization for IN() expressions