doctrine/dbal — pull request #615 by dbehrman (2014-06-05 18:33:53+00:00)
Title: Add sanitization for IN() expressions

The current IN() expression is vulnerable to SQL injection and should be sanitized. It should be noted that the default is set to string because this works for all types including numeric values. However, this method can be slow for large lists. A recent test of 8,000 values too about .38 seconds. Numeric values only take about .015 seconds for the same data set.