I'm having some difficulty figuring out the correct way to do this. If I have a visual force page with a multi-select picklist and I need to run the selected values through a query. The issue is I do not have those values until they select them. For instance, let's say I have John, Dan, and Nancy as the values I know the query would be:
Select FirstName From Contact Where FirstName Includes ('John;Dan;Nancy')
I know there is a limitation with INCLUDES so this wouldn't work.
String s = 'John;Dan;Nancy'; Select FirstName From Contact Where FirstName Includes (:s)
But what if I need to store those values in a variable in the Visual force page. Let's say the user selected John and Dan. I can store those values in a String or String array, but how would you reference those in query? Can you store the multi-select value in string and referenc it a query using the includes statement or would you need to join string in Dynamic SOQL. I'm also wary on SQL Injection, so I'm looking for the best method.