title: Changing to a Parameterized Oracle query
body: <p>I am having the below code for connecting to a Oracle database and returning JSON result. But the below code seems to have issues like sql injection, how can I change them being the current code to the parameterized. Do I just being OracleCommand</p>
  
  <pre><code> public class SampleController : ApiController
    {
       public string Getdetails( int id) 
       {
         using (var dbConn = new OracleConnection("DATA SOURCE=h;PASSWORD=C;PERSIST SECURITY INFO=True;USER ID=T"))
         {
  
              var inconditions = id.Distinct().ToArray();
              var srtcon = string.Join(",",inconditions);
              dbConn.Open();
              var strQuery = @"SELECT PRIO_CATEGORY_ID AS PRIO, LANG_ID AS LANG, REC_DATE AS REC, REC_USER AS RECUSER, DESCR, COL_DESCR AS COL, ROW_DESCR AS DROW, ABBR FROM STCD_PRIO_CATEGORY_DESCR WHERE REC_USER  IN ("+srtcon+")";
              var queryResult = dbConn.Query&lt;SamModel&gt;(strQuery);
              return JsonConvert.SerializeObject(queryResult); 
      }
   }
  </code></pre>