Passing Values to Stored Procedure for "IN" Clause

Question

Hello All:
I am trying to pass values to a stored procedure to use in an IN clause, and getting an "ORA-01722: invalid number".
I believe this has something to do with how .Net handles strings and how I am trying to pass it to my stored procedure.
The values I know need to be IN (2, 1) for the stored procedure to work, and I built a routine that creates a string value to pass in the format "2, 1", but I believe because this value is defined as a string in the .Net code, the leading and trailing apostrophe characters are causing the problem in the stored procedure.
I have in my .Net code the following:
oCommand.Parameters.Add("groupID_", OracleDbType.Varchar2).Value = GroupID;
Where GroupID is defined as a string character, and has values of the following: 2, 1, but due to how .net handles it, it passes as "2, 1".
So of course, inside my stored procedure,
CREATE OR REPLACE PROCEDURE PAYSOL.sp_ProjectsManAppAndFundRpt(
p_Cursor1 OUT SYS_REFCURSOR,
p_Cursor2 OUT SYS_REFCURSOR,
p_Cursor3 OUT SYS_REFCURSOR,
p_Cursor4 OUT SYS_REFCURSOR,
p_Cursor5 OUT SYS_REFCURSOR,
groupID_ IN VARCHAR2)
where I am defining the groupID_ parameter as a VARCHAR2, it is keeping the apostrophes, causing problems when I use it in my IN clause:
AND S.GroupID IN (groupID_)
What do I need to do to pass this value correctly? Is there something I can do inside the stored procedure to strip those characters, or do I need to pass it differently, or completely alter how I am handling this? I don't know the right path to head down, so wanted to seek some help.
Thanks
Andy

Answer 1

IN Clauses and parameterized queries can be tricky beasts; so while logically it makes sense to do what you want (it does not do so in databases!)
you can handle this problem in a few ways:
1) anonymous sql (don't recommend)
2) a user defined type and function as such
--see  http://asktom.oracle.com/pls/asktom/f?p=100:11:0::::P11_QUESTION_ID:210612357425
--create a table of numbers ,create a function to split the "where" into a table
--then return the data
CREATE OR REPLACE type numberTableType as table      of number;
create or replace function in_number(  p_string in varchar2 ) return numberTableType  AS
        l_string        long default p_string || ',';
        l_data          numberTableType := numberTableType();
        l_number        number ;
        N               NUMBER;
    BEGIN
      loop
          exit when l_string is null;
          n := instr( l_string, ',' );
         l_data.extend;
         begin --is user inputs a non-numeric value  skip the value
            l_number := cast(ltrim( rtrim( substr( l_string, 1, n-1 ) ) )  as number);
            l_data(l_data.count) := l_number ;
            EXCEPTION
                    WHEN VALUE_ERROR THEN
                        l_number := 0;
                    WHEN OTHERS THEN
                        raise ;
         end ;
         l_string := substr( l_string, n+1 );
    end loop;
    RETURN L_DATA;
  END in_number;
--then your code
AND S.GroupID IN (select column_value from table(in_number(groupID_))3) actually, just look at this blog posting! it does a better job at this than I am!
http://tkyte.blogspot.com/2006/06/varying-in-lists.html