It would be better to use a parameter like `user_id in :user_ids` (`user_ids = ('id1', 'id2...)`)

You can also use class based filters to prevent you from having to write out the SQL: https://github.com/dimagi/commcare-hq/blob/master/custom/apps/gsid/reports/sql_reports.py#L113-113