I’m using the promised-sqlite3 library here for queries.

At first I tried:

  await db.all('SELECT video, offset, watched FROM watched WHERE user = ? AND video IN ?',
    username(req), videos);

…but that syntax isn’t accepted. Then I tried:

  await db.all('SELECT video, offset, watched FROM watched WHERE user = ? AND video IN (?)',
    username(req), videos);

…which runs without error, but gave me no matches when I should have gotten a few. What works is this:

  await db.all(`SELECT video, offset, watched FROM watched WHERE user = ? AND video IN ('${videos.join("','")}')`,
    username(req));

…but that’s hardly a “best practices” way to do this, even though I do filter the content of the array to prevent SQL injection.

Is there a proper way to pass an array value that I haven’t found yet?