SQL & PL/SQL

I have a simple sql statement that works (in my case, returns 28 rows).

select columna,
columnb
from table
where columnb in ('Value1','Value2')

Next, I can do something like:

select ''''||replace('Value1,Value2',',',''',''')||'''' from dual and it returns a string:

(''''||REPLACE('VALUE1,VALUE2',',',''',''')||'''')
--------------------------------------------------
'Value1','Value2'

What I would like to do, is combine the two statements because the "in" statement will depend on a comma separated value list that the user will supply (which is why I'm trying to format it as an "in" statement would be formatted)

I've tried:

select columna,
columnb
from table
where columnb in (select ''''||replace('Value1,Value2',',',''',''')||'''' from dual);

This SQL statement returns 0 rows instead of my 28 that I think I should get. What am I doing wrong?