Question: I have a string value in the web.config — for example 2 guids separated by a `","`. I need to query the database dynamically (i.e i have no idea how many values could be separated by a comma in the web.config) and run a select statement on the table passing these values and getting all that is relevant for example:

```
select * from tablename where columnname = string1 string2 string3 etc etc

```

some strings may only contain 1 guid some may contain 10

Answer: 
Check out Erland Sommarskogs excellent post on this topic:

<http://www.sommarskog.se/arrays-in-sql-2005.html>

SQL Server 2008 would also offer [table-valued parameters](http://www.sqlteam.com/article/sql-server-2008-table-valued-parameters) in addition to these ways of passing multiple values to the procedure.

Marc
You want an "IN" condition. If you *really* trust your web.config and can require the configured elements are also encased in quotes, you can just put it directly into the sql statement:

```
select * from tablename where columnname IN ( "web.config value here" )

```

But be warned that dynamic sql like this is *very* dangerous. On the other hand, passing them in safely can be [tricky](http://www.sommarskog.se/arrays-in-sql.html).