SQL & PL/SQL :: Using INSTR In Where Clause To Give COMPLETE MATCH Strings?

We have a SSRS Front end screen which sends multi-select column values as comma separated strings to back end ( Oracle 10g) procedure .

The procedure builds the string by inserting single quotes in the following manner.

P_BU_LST is the parameter which have comma separated values

'1234,3456,4577' i.e, BU ids selected by user in front end
the procedure inserts single quotes to this paramer value

i.e., '1234','3456','4577
v_bu_lst := '''' || REPLACE(v_selbu, ',', ''',''')|| '''';

This is used the where clause of the REF CURSOR SELECT query which send the data back to SSRS

ie.,
SELECT BU.*
FROM BU_DETAIL BU
WHERE INSTR(V_BU_LST,BU_ID) <> 0;

INSTR has a chance to fail in this scenario if the value send from the front end is 123456,3456,4577

here 123456 does not exist in table, but it will be true for INSTR and values 1234 from table will be send back to SSRS which is wrong. Earlier I was using a function to convert the comma separated values to multi-rows and treat it like a lookup table.

But the main table has around million records , and each row has to processed against each row of lookup table, which makes it slower. To avoid this I used INSTR which is faster but can give wrong results.