avoid SQL-injection for in values