Question

What am I doing wrong here?

string favorites = "210,213";

sqlCommand.CommandText = "select * from clients (nolock) 
    where Deleted = 0 and ClientID in (@favorites)";
sqlCommand.Parameters.AddWithValue("@favorites", favorites);

One other note: the “210,213” is just an example. It could be any length of numbers. That is why I am using the SQL IN operator.

Thanks.

Answer 1

That’s not how parameters work. You are actually trying to get clients where ClientID is equal to ‘210,213’. Well, that’s not a number, so there’s a failure.

Parametrized queries and IN clause are actually not trivially implemented together if your IN list size is dynamic, changing from time to time.

Read this SO question and answers: Parameterize an SQL IN clause

Generally, you’d have to dynamically assemble your SQL query, always keeping in mind issues like SQL Injection.

Further reading:

• Best practice between these two queries
• Deleting from sqlite database using IN
• problem using Oracle parameters in SELECT IN
• Is it possible to use query parameters to fill the IN keyword