SQL注入参数化带in的处理方法--动态加载

string status = "";
List<Object> liststr = new List<object>();
if (this.chkExamStatus.SelectedIndex != -1)
{
for (int i = 0; i < this.chkExamStatus.Items.Count; i++)
{
if (this.chkExamStatus.Items[i].Selected)
{
liststr.Add(chkExamStatus.Items[i].Value);
}
}
//strSql += " AND V.STATUS in (:status)";
strSql += " AND V.STATUS in (";

string strnamelist = string.Empty;
for (int i = 0; i < liststr.Count; i++)
{
string strname = ":status"+i;
strnamelist += strname + ",";
list.Add(new OracleParameter(strname, liststr[i]));
}
strnamelist = strnamelist.TrimEnd(',').ToString();
strSql += strnamelist +")";

}