試してないけど、こんなんじゃだめなのけ

my @codes = split /,/, '1,2,3,4,5';
my $sql = 'SELECT * FROM TEST WHERE testcode IN (' . join(',', ('?') x @codes) . ')';
my $sth = $dbh->prepare($sql);
$sth->execute(@codes);