nottheexploit.php

<?php

$query = 'SELECT stuff FROM {table} WHERE name = :name and nid IN (:nids);';

$condition = array(
    "1 ;INSERT INTO {test} SET name = 'test12345678'; -- " => '',
    '1' => '',
);

$args = array(
    ':name' => $condition,
    ':nids' => array(5, 6, 7),
);

foreach (array_filter($args, 'is_array') as $key => $data) {
    $new_keys = array();

    foreach ($data as $i => $value) {
        $new_keys[$key . '_' . $i] = $value;
    }

    $query = preg_replace('#' . $key . '\b#', implode(', ', array_keys($new_keys)), $query);

    unset($args[$key]);
    $args += $new_keys;

}

print 'query: ' . $query . PHP_EOL . 'args: ';
var_export($args);