code: protected String constructInStringsQuery(String query, Set<String> values) {
          String replace = "IN (?)";
          assert query.lastIndexOf(replace) == query.indexOf(replace);
          String sql = query.replace("IN (?)", "IN (%s)");
  
          StringBuffer list = new StringBuffer();
          for (String value : values) {
              if (list.length() > 0) {
                  list.append(",");
              }
              value = String.format("'%s'", StringEscapeUtils.escapeSql(value));
              list.append(value);
          }
  
          return String.format(sql, list.toString());
      }
docs: Given a an sql query containing the string "IN (?)" and a set of strings,
  this method constructs a query by safely replacing the first occurence of
  "IN (?)" with "IN ('v1','v2'...)", where v1,v2,.. are in values.
  
  @param query
  @param values
  @return