title: Datacontext ExecuteCommand parameters in IN statement
body: <p>What is the best way to run a custom <code>sql</code> statement using <code>IN</code> from a C# LinQ to sql datacontext? I have tried:</p>
  
  <pre><code>db.ExecuteCommand(
     "UPDATE tblCard SET used = 1 WHERE id IN ({0}) AND customer_id = {1}",
     Request.Form["ids"], customer_id
  );
  </code></pre>
  
  <p>Which is fine for 1 item passed through the form, but if i get posted through for example "2,1" then I get a <code>sqlclient</code> exception:</p>
  
  <blockquote>
    <p>Conversion failed when converting the nvarchar value '2,1' to data type int.</p>
  </blockquote>
  
  <p>If instead I use string.format to insert the parameter it works fine, but obviously this is open to sql injection.</p>