How to safely use the IN command with Python SQLite