<p>Working with a SqlCommand in C# I've created a query that contains a IN (list...) part in the where clause. Instead of looping through my string list generating the list I need for the query (dangerous if you think in sqlInjection). I thought that I could create a parameter like:</p>

<pre><code>SELECT blahblahblah WHERE blahblahblah IN @LISTOFWORDS
</code></pre>

<p>Then in the code I try to add a parameter like this: </p>

<pre><code>DataTable dt = new DataTable();
dt.Columns.Add("word", typeof(string));
foreach (String word in listOfWords)
{
    dt.Rows.Add(word);
}
comm.Parameters.Add("LISTOFWORDS", System.Data.SqlDbType.Structured).Value = dt;
</code></pre>

<p>But this doesn't work. </p>

<p>Questions:</p>

<ul>
<li>Am I trying something impossible?</li>
<li>Did I took the wrong approach?</li>
<li>Do I have mistakes in this approach?</li>
</ul>

<p>Thanks for your time :)</p>

You want to think about where that list comes from.  Generally that information is in the database somewhere.  For example, instead of this:
```
```
SELECT * FROM [Table] WHERE ID IN (1,2,3)
```
```
You could use a subquery like this:
```
```
SELECT * FROM [Table] WHERE ID IN ( SELECT TableID FROM [OtherTable] WHERE OtherTableID= @OtherTableID )
```
```