My database has two tables that have master-child relationship. They are School and Student. Each school can have any number of students.

A user has selected a number of schools. Next, they want to display all students for these schools.

Suppose I have 3 schools. Their primary key values are 43, 44, and 45. How do I parameterize the IN clause of the following SQL.

SELECT * FROM Student WHERE SchoolId IN (@0);

Is it legal to substitute @0 with a comma-separated string of ids, like this: '43,44,45', or do I pass something with brackets, like '(43,44,45)'