You mention you've concatenated together the values into the
$_GET['idList']
value so what you'll need to do is split the values again back into an array before you can iterate over them.
You can split using the
PHP: explode - Manual[
^] function, which will take the string value and split it based on a delimiter.
For example, if your string has been concatenated with a comma as the delimiter then you'd need to explode on that:
$idList = $_GET['idList'];
$idArray = explode(",", $idList);
foreach ($idArray as $id) {
$id = htmlspecialchars($id);
}