While a simple delimiter might work for simple cases, if you every have to deal with quotes or other complex strings, a reliable way to encode lists would be to encode that into a JSON string and then use JSON_PARSE() in your query:
SELECT .... WHERE ARRAY_CONTAINS(JSON_PARSE(:param), column)
:param just needs to be of type string holding a JSON encoded array such as '["foo", "bar", "foo,bar", "\"foo\""]'