I have a table that has a column named category. The column category has values like "6,7,9,22,44". I would like to know if this approach is an efficient approach for SQL Server 2005 or 2008. I basically pass in the "6,7,9,22,44" value to the stored procedure. I am open links/suggestions for a better approach.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Note: I should clarify that I am maintaining an app written by someone else and the category column already has comma separated values. I would have placed the data in a separate table but I won't be able to do that in the short term. With regards to SQL Injection - The column is populated by values checked from a checkbox list. Users cannot type in or enter any data that would affect that specific stored proc. Is SQL injection still possible with that scenario? Please explain how. Thanks.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

```
CREATE PROCEDURE [dbo].[GetCategories]
    -- Add the parameter that contain the string that is passed in
    @catstring varchar(300)
AS
DECLARE @SQLQuery nvarchar(500); 
BEGIN

    /* Build Transact-SQL String with parameter value */
    SET @SQLQuery = 'select id,category from categoryTable where id in ('+ @catstring +')' 
    /* Execute Transact-SQL String */
    EXECUTE(@SQLQuery)
END
GO

```