A text input box should serve unless there's some reason you can't have users enter the parameters -- separated by whatever works well as a record separator given the kind of terms you expect -- and then use your cgi to separate them and send them on to the DB