prepare breaks quotes for IN. * * @param [array] $items * @return string */ public static function array_to_sql_safe_list( $items ) { $items = array_map( function ( $item ) { global $wpdb; return $wpdb->prepare( '%s', $item ); }, $items ); return implode( ',', $items ); } }