Function bulk_update 

pub async fn bulk_update(
    db: &Db,
    table: &str,
    ids: &[String],
    field: &str,
    value: &str,
) -> Result<(), Error>

UPDATE table SET "<field>" = ? WHERE "id" IN (?, ?, …).

Each id is bound positionally — the IN-clause placeholders are generated from ids.len(), never spliced from caller text. field and table go through [quote_ident]. Empty ids is a no-op so callers don’t need to gate the call.