How can i search for the same input parameter - sql-server

Question

My input parameter is :
exec [dbo].[MULTI_VALUED_USER_INPUT_PARAMETER] N'2040,2041,2044,2047,2048'
I need to search in a data base where i have to search in those inputs like this
Product IN ('2040','2041','2044','2047','204048')
How can i convert the input parameter to put it inside the " Product" search one at a time
UPDATE
I need to split the input to be list of strings to be able to search in them

Answer 1

You can use a dynamic query and pass the IDs in the query directly but this option is vulnerable to SQL Injection. Therefore, you should split up the IDs first and then join it with your actual table. Your procedure should be like this:
CREATE PROCEDURE [MULTI_VALUED_USER_INPUT_PARAMETER] #Ids NVARCHAR(1000)
AS
--DECLARE #Ids NVARCHAR(1000) = N'2040,2041,2044,2047,2048'
;WITH CTE
AS(
SELECT CAST('<N>' + REPLACE(#Ids,',','</N><N>') + '</N>' AS XML) [XMLids]
)
SELECT T.a.value('.', 'INT') AS ID,yt.*
FROM CTE
CROSS APPLY CTE.XMLids.nodes('/N') AS T(a)
INNER JOIN dbo.YourTable yt
ON T.a.value('.', 'INT') = yt.Product
NOTE: I assumed that the IDs are INT by default, if not, please update the code. You can replace the JOIN with IN clause easily if required.

Answer 2

you are passing a string like this
N'2040,2041,2044,2047,2048'
and you are expecting it to be parsed as comma seperated values..so you need to parse the input first..
you could use split string available from here and do the parse like below in your proc..
select * from split_String(#String,',')
and pass the above input in the place where you are passing string in stored proc
split string source code:
CREATE FUNCTION dbo.SplitStrings_Numbers
(
#List NVARCHAR(MAX),
#Delimiter NVARCHAR(255)
)
RETURNS TABLE
WITH SCHEMABINDING
AS
RETURN
(
SELECT Item = SUBSTRING(#List, Number,
CHARINDEX(#Delimiter, #List + #Delimiter, Number) - Number)
FROM dbo.Numbers
WHERE Number <= CONVERT(INT, LEN(#List))
AND SUBSTRING(#Delimiter + #List, Number, LEN(#Delimiter)) = #Delimiter
);
GO
Numbers table :
CREATE TABLE Numbers
(
Number INT NOT NULL,
CONSTRAINT PK_Numbers
PRIMARY KEY CLUSTERED (Number)
WITH FILLFACTOR = 100
)
INSERT INTO Numbers
SELECT
(a.Number * 256) + b.Number AS Number
FROM
(
SELECT number
FROM master..spt_values
WHERE
type = 'P'
AND number <= 255
) a (Number),
(
SELECT number
FROM master..spt_values
WHERE
type = 'P'
AND number <= 255
) b (Number)
GO

Answer 3

What I understood is that you want to execute that store procedure with different parameters, which have to be included in the IN clause you wrote.
You can do this:
DECLARE #Product INT = 0
-- Iterate over all products
WHILE ( 1 = 1)
BEGIN
-- Get next productID
--Since you didn't show us how is your product tables I had to make up a little,
SELECT TOP 1 #Product = Product
FROM Products
WHERE Product > #Product
ORDER BY Product
-- Exit loop if no more products
IF ##ROWCOUNT = 0 BREAK;
-- call your sproc
EXEC [dbo].[MULTI_VALUED_USER_INPUT_PARAMETER] #Product
END