It should be shown automatically. Can you print out $sql variable, just before execution. This way you can see if it is constructed correctly....
Separate names with a comma.