Your regex pattern has two problems:
1. it has * as the character counter, which means "0 or any number of charcaters frm the class".
This means that a string containing even none (0) of your characters will match your expression
2. you didn't specify that there cannot be other characters before and after the pattern
Here is how it should be:
$ids_list = '112,5,16,4578';
if (preg_match('/^[0-9,]+$/', $ids_list))
echo'OK!';
else
echo'KO!';
The "+" sign after the character class says there should be at least 1 character from there
The ^ at the beginning and $ at the end say you cannot have other characters before and after the string matching your pattern.
However, this solution will also match "," - a single comma string.
Maybe a better one would be
$ids_list = '112,5,16,4578';
if (preg_match('/^[0-9]+(,[0-9]+)*$/', $ids_list))
echo'OK!';
else
echo'KO!';
This matches a string containing a group of 1 or more digits, followed by 0 or more groups of a comma followed by some digits
;)