Looks like a classic SQL injection mistake... the string passed into `format()` should be the bind parameters and the ids themselves can be passed as arguments.