That SQL query won't work anyway:
product='9' AND '14' AND '16'
Is not a valid boolean expression (ignoring that it logically can't be true under any circumstances even if your corrected it)
So what you want to use is
SELECT * FROM products WHERE product IN (9, 14, 16)
Assuming you have stored numbers in your table not strings.
So...can you convert a list to a string, with commas? Yes:
List<int> myList = new List<int>();
...
string s = string.Join(",", myList.Select(i => i.ToString()));
Or, you could store the Session variable as a string:
Session["MyList"] = (string) Session["MyList"] + "," + product;
[edit]
In fact, you don't need the Select:
List<int> myList = new List<int>();
...
string s = string.Join(",", myList);
Will do exactly the same thing... :doh:
[/edit]