$userinput =~ s/[^a-z]+/,/gi; # replace anything but a-z by comma

my $q = "SELECT * FROM <table> WHERE <column> IN ($userinput)";