I'm trying to figure out how to properly use a WHERE **\_ IN \_** statement

Definition:

```
c.execute('''CREATE TABLE IF NOT EXISTS tab (
    _id integer PRIMARY KEY AUTOINCREMENT,
    obj text NOT NULL
    ) ;''')

```

I'm trying to do something like this:

```
list_of_vars=['foo','bar']
statement="SELECT * FROM tab WHERE obj IN (?)"
c.execute(statement,"'"+"','".join(list_of_vars)+"'")

```

Alternatively, I've also tried this, which directly evaluates to the above

```
statement="SELECT * FROM tab WHERE obj IN (?)"
c.execute(statement,"'foo','bar'")

```

The error I am getting is:

```
sqlite3.ProgrammingError: Incorrect number of bindings supplied. The current statement uses 1, and there are 9 supplied

```

This is giving me an error. When I do it this way, it works, but this is not recommended as it is vulnerable to a SQL injection attack.

```
statement="SELECT * FROM tab WHERE obj IN ("+"'"+"','".join(statement)+"'"+")

```