The general approach in this case would be to parse the comma-separated list into an Oracle collection and to use that collection in your SQL statement. Tom Kyte has an example of this in his discussion on variable IN lists.
Assuming you create the myTableType type and the in_list function from that thread, you should be able to do
SELECT *
FROM employee
WHERE employee_number IN (
SELECT *
FROM TABLE( in_list( p_your_comma_separated_list ) )
)