SQLQuery
You can pass this sort of thing as a clause in any db function.
Otherwise, you can pass a dictionary to the keyword argument vars
and the function will call reparam for you.
The SQLQuery class is accessible via the web.db module.
Methods
See the source for more information.