While looking at code (accesslib.php), I've detected a lot of uses of IN() statements where the list of values continues being passed as comma-separated string.

While it works... ideally all them should be converted to proper ? placeholders, correct?

Pasting here the function used in Mahara (suggested by Penny):

/**
 * function to convert an array to
 * an array of placeholders (?)
 * with the right number of values
 *
 * @param array $array input array
 */
function db_array_to_ph($array) {
    return array_pad(array(), count($array), '?');
}

note it's enough for us, needing to support :named parameters. And also note it returns an array and should return one string directly.

Not checked if we have implemented this our way (it sounds to me that yes).

Ciao :-)