The solutions are either to use a placeholder for each item you need to match (three items, three placeholders, for examples), or, don’t use a placeholder and, instead, concatenate the entire SQL string and execute.
https://stackoverflow.com/questions/2445029/sql-placeholder-in-where-in-issue-inserted-strings-fail

