Prepared statement with variable number of parameters

I need a secure prepared statement which will have a variable number of parameters to bind variables. The code needs to be safe from sql injection, and very secure.

My form is submitted via AJAX, the prepared statement is on PHP page called by AJAX. The form is long and many of the questions are optional and may not be answered by the user. I only want to query the table based on the inputs that the user has answered.

For example:
I have several dynamically created checkboxes with the same name (but different values) in my form. Depending on which are checked by the user, I need to query the database for only the checkbox values selected PLUS whichever other form elements the user has selected.