Pass a vbscript String list to a SQL "in"operator -

in vb script have select statement trying pass string value undetermined length sql in operator below code works allows sql injection.

i looking way use ado createparameter method. believe different ways have tried getting caught in data type (advarchar, adlongchar, adlongwchar)

    dim studentid  studentid = getrequestparam("studentid")  dim rsgetdata, dbcommand     set dbcommand = server.createobject("adodb.command")     set rsgetdata = server.createobject("adodb.recordset")     dbcommand.commandtype = adcmdtext     dbcommand.activeconnection = dbconn dbcommand.commandtext = "select * students studentid in (" & studentid & ")" set rsgetdata = dbcommand.execute() 

i have tried

call addparameter(dbcommand, "studentid", advarchar, adparaminput, nothing, studentid) 

which gives me error adodb.parameters error '800a0e7c' problems adding parameter (studentid)=('sid0001','sid0010') :parameter object improperly defined. inconsistent or incomplete information provided.

i have tried

call addparameter(dbcommand, "studentid", adlongvarchar, adparaminput, nothing, studentid) 

and

    dim studentid  studentid = getrequestparam("studentid")  dim slength slength = len(studentid) response.write(slength)  dim rsgetdata, dbcommand     set dbcommand = server.createobject("adodb.command")     set rsgetdata = server.createobject("adodb.recordset")     dbcommand.commandtype = adcmdtext     dbcommand.activeconnection = dbconn dbcommand.commandtext = "select * students studentid in (?)"     call addparameter(dbcommand, "studentid", advarchar, adparaminput, slength, studentid) set rsgetdata = dbcommand.execute() 

both of these options don't anything... no error message , sql not executed.

additional information:

studentid being inputted through html form textarea. design able have user input list of student id's (up 1000 lines) , perform actions on these student profiles. in javascript on previous asp have function takes list , changes comma delimited list '' around each element in list.

classic asp not have support this. need fall 1 of alternatives discussed here:

http://www.sommarskog.se/arrays-in-sql-2005.html

that article kind of long, in way: it's considered many standard work on subject.

it happens preferred option not included in article. use holding table each individual item in list, such each item uses ajax request insert or remove holding table moment user selects or de-selects it. join table list, end this:

select s.*  students s inner join studentselections ss on s.studentid = ss.studentid ss.sessionkey = ?