Question: I originally had this working:

url: `http://server/blah.php?FacilityCode=FT`

```
$facilitycode = mysql_real_escape_string($_GET["FacilityCode"]);
$sql = "SELECT ..." .
       "FROM ..." .
       "WHERE ..." .
       "AND ('" . $facilitycode . "' = '' OR Facility.FacilityCode = '". $facilitycode . "')";
$result = mysql_query($sql);

```

But I want to change this so that people can submit multiple values in the query strying somehow, ie: `http://server/blah.php?FacilityCode=FT,CC,DD,EE`

I tried changing the query to an "IN" clause instead of an "equals" but I'm not sure how to get the ' marks around each element.

Answer: 
Use `implode()` function for IN (...).

```
$a = array('AB', 'CD', 'EF', 'ZE');
echo "field IN ('" . implode("', '", $a) . "')";

```

... will output:

```
field IN ('AB', 'CD', 'EF', 'ZE')

```

+escape every option you get.
If your trying to create a string which looks like this: 'AB', 'CD', 'EF', 'ZE'

Try this before its placed inside the query:

```
$facilitycode = preg_replace('/([^,]+)/', '\'$1\'', $facilitycode);

```