How to fix the filter?

Question

PHP

Hello, I wrote this code

$query = "SELECT * FROM products WHERE brand =  '".$_POST["category"]."' ";

   $brand = $_POST['category']; 
if (isset($brand)){
  
  $brandsdata =implode(",", $brand);
  $query .= " AND brand IN('$brandsdata')";

}

The essence of the problem is that $brandsdata does not matter made a vardump check

"SELECT * FROM products WHERE brand = 'Gigabyte' AND brand IN('')"

What is my mistake? The post is an array and the imploud should turn it into a string. But for some reason it does not.

Answer 1

Replace with And more:
Read about SQL Injection