title: C# Parameterized Query MySQL with `in` clause
body: <p>I am in the process of converting several queries which were hard-coded into the application and built on the fly to parameterized queries. I'm having trouble with one particular query, which has an <code>in</code> clause:</p>
  
  <pre><code>UPDATE TABLE_1 SET STATUS = 4 WHERE ID IN (1, 14, 145, 43);
  </code></pre>
  
  <p>The first parameter is easy, as it's just a normal parameter:</p>
  
  <pre><code>MySqlCommand m = new MySqlCommand("UPDATE TABLE_1 SET STATUS = ? WHERE ID IN (?);");
  m.Parameters.Add(new MySqlParameter("", 2));
  </code></pre>
  
  <p>However, the second parameter is a list of integers representing the ids of the rows that need updating. How do I pass in a list of integers for a single parameter? Alternatively, how would you go about setting up this query so that you don't have to completely build it each and every time you call it, and can prevent SQL injection attacks?</p>