Discussion on answer by Ja1024: Is SQL Injection possible if we're using only the IN keyword (no equals = operator) and we handle the single quote

Imported from a comment discussion on https://security.stackexchange.com/questions/279871/is-sql-injection-possible-if-were-using-only-the-in-keyword-no-equals-operat/279872#279872