This is the scenario when this is done inappropriately. You build the actual SQL (what the commas and quotation marks are), and passing it as a parameter. It basically evaluates value3 IN ('...') , where ... is the completeness of $values .
Also, this is a good call about quotes. MySQL uses single quotes.
You will need to either build SQL using only string concatenation, or use several parameters.
EDIT
As an example:
$values = array('a','b','c','d'); $values = "'" . implode("','", $values) . "'"; $stmt->prepare('SELECT value1, value2 FROM table1 WHERE value3 IN (' . $values . ')');
source share