Sending an array of values to Oracle procedure to use in WHERE IN clause

Question

I have a stored procedure in Oracle as shown below:
<p><h5><font color=NAVY>CREATE PROCEDURE MY_TEST_PROC(
CUR OUT SYS_REFCURSOR,
PARAM_THAT_WILL_BE USEDINSIDE_WHERE_IN
AS
BEGIN
OPEN CUR FOR
SELECT *
FROM MY_TABLE
WHERE COL1 IN (here I want to put values received from C#)
END;</font></h5></p>
On the ASP.NET application side I have a select element with several options. I want to use these list items in my WHERE clause. I know that I can have a VARCHAR2 input parameter in my stored proc, make a comma separated string from the list items, send it to the procedure. There are two concerns with going this way:
1.I make my website vulnerable to SQL injections
2.In my stored proc I have to use EXECUTE ('SELECT ...') pattern which I would like to avoid.
How can I send these list items to the stored procedure and use them inside the WHERE IN clause? I'm using ODP.NET and have heard of UDT but don't know how to use it.

Answer 1

Assuming a connection variable called conn and Java String array called myStringArray, here's the gist of it:
ArrayDescriptor descriptor1 = ArrayDescriptor.createDescriptor("STRING_ARRAY", conn);
ARRAY array1 = new ARRAY(descriptor1, conn, myStringArray);
OracleCallableStatement cs = (OracleCallableStatement) conn.prepareCall(sql);
cs.setARRAY(1, array1);