Unfortunately, the sqlite database API does not support binding arrays to a prepared statement: https://www.sqlite.org/c3ref/bind_blob.html

I want to suggest that you assemble the query string based on the arguments -- the suggested implementation in SO seems reasonable.

Or, you may want to look into an ORM that is a bit higher-level and will provide support for more complex queries.

Oh, so the limitation is there. Have you (or anyone) requested this from Dwayne? What is their position on the matter?

@forthrin I don't know of any SQL database that supports such a feature. I briefly looked at postgresql and mysql docs and they have similar APIs.

If this is something you're interested in pursuing, I'd recommend you bring it up with the upstream projects.

Kind of you to do a round trip. I truly support developer restraint to prevent software bloat, but it would be interesting to know why it's not considered important enough, particularly since it paves the way for malicious injection.

The thing that comes to mind is that in/exclusion in a SQL paradigm is most commonly done by joining against other tables, and checking against lists inserted from code might be considered "unclean".

Also, if exclusions are one per row, they can just as well be done in code afterwards, but obviously exclusions that hit many rows per entry would be very ineffective that way.

I'll consider posting a request on the SQLite forum, referring to this posting.