$array = explode (",",$_GET["yskno"]);
$list = "'". implode("', '", $array) ."'";

sql =" ... IN ({$list}) "