theres no loop, you are updating all records which have a userid in the comma separated list and match youre where/and statements. Try wrapping each value in quotes (if the columns are int you dont need to do this)
you could also try this
[php]
if (mysql_num_rows($query)) {
$ary = array();
foreach (mysql_fetch_assoc($query) as $key => $val) {
$ary[] = $val;
}
$ary = implode(',',$ary);
}
[/php]
Its doing the same thing in a different way. if that still fails, post the relevant code.