Answers so far have been templating the values into a plain SQL string. That’s absolutely fine for integers, but if we wanted to do it for strings we get the escaping issue.
Here’s a variant using a parameterised query that would work for both:
placeholder="?" # For SQLite. See DBAPI paramstyle. placeholders=", ".join(placeholder for unused in l) query= 'SELECT name FROM students WHERE id IN (%s)' % placeholders cursor.execute(query, l)