Though I agree with comments here about normalizing
databases, if you are stuck with this, here is a solution. A query
of a query. Converts your 1,2,3,4,5,6 to '1','2','3','4','5','6'
which can then be used with the SQL operator IN.
<!--- Make sure your search parameter is surrounded by
single quotes, then surrounded by double quotes --->
<cfset Form.search = "'2'">
<cfquery name="q1" datasource="yourDatasource">
select * , '''' + REPLACE(csv_data,',',''',''') + '''' as
mod_data,
'#Form.search#' as search_parm
from test
</cfquery>
<cfquery dbtype="query" name="q2">
select * from q1
where search_parm IN (mod_data)
</cfquery>
<cfoutput query="q2">
#anyColumnYouSelectedInQuery1or2#<br>
</cfoutput>