Escape Array in SQL. How to do it?

[eluser]behnampmdg3[/eluser]
Hi;

Escaping only works within a quoted SQL string. It prevents the user from breaking out of this string. In this SQL below since I insert the value directly into the query without quoting it, the escaping is completely pointless. It has no effect at all. And if it did, you'd break the query. Because then you'd have an IN expression with a single big string in it.

How can I quote and escape the invidual IDs?

Code:

$sql = "SELECT
           *
       FROM   ad_have
           INNER JOIN members
             ON members.id = ad_have.member_id
         INNER JOIN au_postcodes
             ON au_postcodes.id = ad_have.suburb
         LEFT OUTER JOIN
          (SELECT ad_ID, ad_have_photo.photo FROM ad_have_photo GROUP BY ad_ID) AS Q_PHOTO  ON Q_PHOTO.ad_ID = ad_have.id
                
       WHERE ad_have.active = 'y'
       AND ad_have.id IN ".$this->db->escape_str($ad_ids)."
       AND ad_have.weekly_rent > 0
       ORDER BY ad_have.id DESC ";