title: generating WHERE IN () with groovy.sql
body: <p>Is there a way to get Groovy's SQL library to generate a WHERE ... IN () that also protects against SQL injection?</p>
  <p>I've tried the following (where stateList is a List or a String[] - I tried both):</p>
  <pre><code>WHERE p.state IN (${stateList})
  </code></pre>
  <p>The query was <code>WHERE p.state in (QLD, NSW)</code> - the strings are unquoted</p>
  <pre><code>WHERE p.state IN (${stateList.join(','})
  </code></pre>
  <p>The query was <code>WHERE p.state in (QLD, NSW)</code> - the strings are unquoted</p>
  <pre><code>WHERE p.state IN (${stateList})
  </code></pre>
  <p>The query was <code>WHERE p.state in ('QLD', 'NSW')</code> - the strings are quoted but I can inject SQL through stateList</p>