title: Parameterized Queries with LIKE and IN conditions
body: <p>Parameterized Queries in .Net always look like this in the examples:</p>
  
  <pre><code>SqlCommand comm = new SqlCommand(@"
     SELECT * 
     FROM   Products 
     WHERE  Category_ID = @categoryid
  ", 
     conn);
  comm.Parameters.Add("@categoryid", SqlDbType.Int);
  comm.Parameters["@categoryid"].Value = CategoryID;
  </code></pre>
  
  <p>But I'm running into a brick wall trying to do the following:</p>
  
  <pre><code>SqlCommand comm = new SqlCommand(@"
     SELECT * 
     FROM   Products 
     WHERE  Category_ID IN (@categoryids) 
        OR  name LIKE '%@name%'
  ", 
     conn);
  comm.Parameters.Add("@categoryids", SqlDbType.Int);
  comm.Parameters["@categoryids"].Value = CategoryIDs;
  comm.Parameters.Add("@name", SqlDbType.Int);
  comm.Parameters["@name"].Value = Name;
  </code></pre>
  
  <p>Where</p>
  
  <ul>
  <li>CategoryIDs is a comma separated list of numbers "123,456,789" (without quotes)</li>
  <li>Name is a string, possibly with single quotes and other bad characters</li>
  </ul>
  
  <p>What's the right syntax for this?</p>