SQL query filtering by list of parameters

Question

I have a query where I want to return all the rows which are associated with a list of values. You could write this very simply as:

select * from TableA whe         


        

Answer 1

You can easily write this:

String csvString = "1, 2, 3, 5"; // Built the list somehow, don't forget escaping
String query = "select * from TableA where ColumnB in (" + csvString + ")";

By this way, performance doesn't decreased, and you can prevent Sql Injection simply escaping input values while creating csvString.

BTW, if you use MS SQL instead of standard SQL, you can find alternative ways.