Just noticed an error in my UPDATE script. New version below (and full script attached again):

Have a look at Table-Valued Parameters, specifically the section titled "Configuring a SqlParameter Example". It explains everything you need on how to use those SP's I provided from...

No, don't use a cursor.

You can define table parameters in C#. I'd suggest keeping with the Custom Table Data Type and incorporating it into your application, rather than a delimited string.

Have a...

Ok, that was a lot of work... Now, I'm made the comment in the script I've made as well, however, I'm going to repeat i'm not 100% happy with this....

I'll start off with an introduction anyway. This version below will avoid injection. I've commented the lines, which should help you understand what it's doing. if however, you don't, please...

As it stands, this is really a disaster waiting to happen: https://www.sqlservercentral.com/Forums/1914914/using-araylist-in-stored-proc

Really hope the OP entertains fixing the real problem, and it's fixed, before any one starts...