WPDB Placeholders and second argument for prepared statements

Just use %s for string and %d for digit replacements. Do not forget to use the proper esc_*() functions (use full text search for esc_ in the function reference).

global $wpdb;
$wpdb->show_errors = true;
$wpdb->suppress_errors = false;
! defined( 'DIEONDBERROR' ) and define( 'DIEONDBERROR', true );

$sql = <<<SQL
SELECT ID 
FROM {$wpdb->posts} 
    WHERE post_type="attachment" 
    AND ID IN (%s) 
    ORDER BY menu_order 
    ASC
SQL;

# Make sure to `esc_*()` the arguments properly!
$statement = $wpdb->prepare( $sql, implode( "','", $slideshow_imgs ) );
# Example: Query … there are other methods as well:
$wpdb->query( $statement );
# DUMP the result and any possible errors
var_dump( $wpdb->last_query, $wpdb->last_error );