VB create In Clause to pass to Stored Proc

[VBCrazyCoder]

I have VB create a Where clause that I want to pass to a stored procedure in SQL Server.

For example, @myParameter that I am passing in is ("A", "B", "C") and I want to say in my stored proc: Where item IN @myParameter.

Is this possible? It only seems to think that @myParameter is a single item and tries to match the whole string ("A", "B", "C") instead of "A" or "B" or "C".

Any suggestions?

[Edneeis]

Huh? It seems like you are trying to pass three values to the same parameter. I think I must have missed something.

[VBCrazyCoder]

I am trying to pass the string that I want to be used in the WHERE IN clause.

WHERE IN (my parameter value here)

[Lunatic3]

I was stuck with the same issue in access queries. What i did was rebuilding the query in the code. But it does not seem to be a wise solution for Stored Proc.

[hellswraith]

I always thought that stored proceedure parameters won't allow that because of SQL Injection attacks. If you think about it, lets say someone specified a parameter of:

;DELETE * FROM Users;

Your parameter would now look like this:
WHERE IN 'A' ;DELETE * FROM Users; 'B'

.... So SQL parameters won't allow that.

What you can do is either run the statement using a regular sql statement without SP's, or provide enough parameters for all the options you need, then use If statements and what not to get the desired effect inside the SP.

[Lunatic3]

You may look at here for possible answer:
http://www.algonet.se/~sommar/arrays-in-sql.html