Passing arrays to SQL server as parameter

A slow and dirty way:

@param = ',one,two,three,'
SELECT * FROM foo WHERE @param LIKE '%,'+bar+',%'