dev>>cat t.sql                           
set echo on
set verify on
select replace('&1', '^', '''') from dual;

dev>>export X=^1^,^2^,^3^                
dev>>sqlplus tst/tst1@dev1 @t.sql $X

SQL*Plus: Release 9.2.0.6.0 - Production on Wed Mar 28 13:51:19 2007

Copyright (c) 1982, 2002, Oracle Corporation.  All rights reserved.


Connected to:
Oracle9i Enterprise Edition Release 9.2.0.8.0 - 64bit Production
With the Partitioning option
JServer Release 9.2.0.8.0 - Production

SQL> set verify on
SQL> select replace('&1', '^', '''') from dual;
old   1: select replace('&1', '^', '''') from dual
new   1: select replace('^1^,^2^,^3^', '^', '''') from dual

REPLACE('^1
-----------
'1','2','3'

SQL> 

define inlist=&1
...
SELECT something FROM mytable
 WHERE something NOT IN ( &inlist );

#!/bin/sh
echo 'enter input:'
read inpar

l_var=`echo ${inpar} | sed "s/'//g" `
echo 'new value:' $l_var

$ cat test.sql
select sysdate from dual
 where dummy not in( &list1 );
exit

$ sqlplus -s user/pass <<END
> define list1="'1','2'"
> @test
> exit
> END

SQL> SQL> old   2:  where dummy not in( &list1)
new   2:  where dummy not in( '1','2' )

dev>>cat t1.sql                             
set echo on
set verify on
select * from ABC where col1 in (&1);

dev>>export X=\"\'1\',\'2\',\'3\'\" 
dev>>echo $X                                
"'1','2','3'"
dev>>sqlplus tst/tst1@dev1 @t1.sql $X  

SQL*Plus: Release 9.2.0.6.0 - Production on Thu Mar 29 11:20:39 2007

Copyright (c) 1982, 2002, Oracle Corporation.  All rights reserved.


Connected to:
Oracle9i Enterprise Edition Release 9.2.0.8.0 - 64bit Production
With the Partitioning option
JServer Release 9.2.0.8.0 - Production

SQL> set verify on
SQL> select * from ABC where col1 in (&1);
old   1: select * from ABC where col1 in (&1)
new   1: select * from ABC where col1 in ('1','2','3')

      COL1 COL2
---------- ----------
         1 hello
         2 hello2
         3 hello3

SQL>