SQL Server 2005 makes it pretty easy to deal with XML. I'd probably just serialize whatever collection there is on the client side to XML, pass that to a stored procedure, then query against it.

I would think that it should work fine with commas, if it were between a pair of apostrophes SQL should know that it is part of a string. Hell, maybe that really is the way that it works, and I ...