I have a field in my Customers table called Skills. The customer could have more than one skill so I store the Skill_IDs as a comma separated list in the Skills field. I also have a Skills table with Skill_IDs and Skill_Descriptions. After retrieving the comma separated list of Skill_IDs, I need to display them as the Skill_Descriptions. What is the best approach for this?
My approach was to spit the list into an array, then dynamically create a SQL statement on the Skills table to retrieve the descriptions whilst navigating through the array of Skill_IDs. However, I am worried about security using this approach so I really need a way of passing the IDs to an sproc to retrieve the Skill_Descriptions. Note the comma separated list could be anything - eg. 1,2,3 or 3,4 or 4,5,8.