sql server programming: This is probably an old question, but is it possible to
pass a string of comma separated values in a param to a
stored proc that can then be used in an IN() clause?

There are few ways to do it. The most poplar way is to build the sql
statement into a varchar and then execute it with EXEC (@SqlString). I
don't like this way because then I need to give permissions on the base
tables and more importantly, when I execute a string that was based on the
user's input, there is always the risk of SQL Injection.

My favorite way is to create a user defined function that returns a table.
The function gets the string and put each value as a record, then I do a
join with the user defined function.

Adi
[quoted text, click to view]