Dynamic SQL (watch for SQL injection) or a string splitter function. I recommend the latter. Search this site for 'Delimited8kSplit'

Oh, and as for why your attempt failed, that equates to this:

SELECT *

FROM [AttributeList]

WHERE [AttributeID] = '1 OR [AttributeID] = 3 OR [AttributeID] = 6 OR [AttributeID] = 2808';

ie where the attribute is equal to that long string, which I'm sure you'll agree isn't going to do what you want