This works for me.

Declare @Names as varchar(8000)

set @Names = 'SysObjects, SysIndexes'

--this is in your stored proc :

set @Names = ',' + Replace(@Names, ' ', '') + ','

Select Id, Name, XType from dbo.SysObjects where charindex (',' + Name + ',' , @Names, 1) > 0

Please note that this script assume that the comma and the space isn't gonna come up in any of the ids

However if you think that you may go well over the 8000 limit of the varchar you may consider creating a Table like this :

WantedOrders

Order_id

User_id (that requests them so multiple users can use this table)

then you can simply join to that table and get the orders you want. However this forces you to make a big ( or bulk) insert then a join and then a delete to complete the task, while the in() method can simply select but is limited in quantity. I am unaware of the requirements of your software but you may play with both solutions and see which fits better under different loads of ids to list.