title: Passing multiple values to single parameter in SQL inline query using C#
body: <p>I am new to coding and looking for some help on how to pass multiple values to a single parameter in an inline SQL query. I have framed the below query, but I heard this could result in SQL-injection issue. Kindly help on how can I frame the below by using parameter based in the SQL query.</p>
  
  <pre><code>string query = "Select ID, email FROM DBTABLE WHERE email in (";
  var stringBuiler = new StringBuilder();
  using (StringReader stringReader = new StringReader(DownloadIDtextBox.Text))
  {
      string line;
      string prefix = "";
      while ((line = stringReader.ReadLine()) != null)
      {
          stringBuiler.Append(prefix);
          prefix = ",";
          stringBuiler.Append("'" + line + "'");
      }
  
  }
  query += stringBuiler.ToString() + ")";
  SqlDataAdapter da = new SqlDataAdapter(query, Connection);
  DataTable dt = new DataTable();
  da.Fill(dt);
  </code></pre>
  
  <p>Just want to mention that ID is GUID format.</p>