title: SqlParameter and IN statement
body: <p>I need following query:</p>
  
  <pre><code>createList(string commaSeparatedElements) {
      ...
      SqlCommand query = new SqlCommand("SELECT * FROM table WHERE id IN ("+commaSeparatedElements+")");
      ...
  }
  </code></pre>
  
  <p>I would like to write it using a parameterized query, so every element from the string is checked to prevent against Sql-Injections.</p>
  
  <p>Pseudo-code:</p>
  
  <pre><code>createList(string commaSeparatedElements) {
      ...
      SqlParameterList elements = new SqlParameterList("@elements", SqlDbType.Int);
      SqlParameterList.Values = commaSeparatedElements.split(new Char[1] {','});
      SqlCommand query = new SqlCommand("SELECT * FROM table WHERE id IN (@elements)");
      query.Parameters.Add(elements);
      ...
  }
  </code></pre>
  
  <p>Does anything like that exist in C#, or will I have to write it by myself?</p>
  
  <p>EDIT: Thanks for all the answers. As I try not to use code I don't understand (too many bad experiences in the last days), dapper and table-valued parameters, even though they may be perfect for my needs, are off-limits. I just made a loop.</p>
  
  <pre><code>string[] elements = commaSeparatedElements.split(new Char[1] {','});
  StringList idParamList = new StringList();
  for(int i=0;i&lt;elements.Count;i++) {
      query.Parameters.AddWithValue("@element"+i,Convert.ToInt32(elements[i]));
      idParamList.Add("@element" + i);
  }
  SqlCommand query = new SqlCommand("SELECT * FROM table WHERE id IN ("+String.Join(",",idParamList)+")");
  </code></pre>