store procedure

You add a parameter to the SqlCommand object like so;

cmd.Parameters.AddWithValue("@privillege", privillege);

also don't forget to change the SqlCommand.CommandType to stored procedure e.g.

cmd.CommandType = CommandType.StoredProcedure;

However in your case with the query as specified you can't use parameters as you are using IN as part of the WHERE clause you can't pass parameters for use in this case.

pass "privillege" as varchar parameter and in your procedure use sp_executesql to execute statement

create proceudre getitems 
@privilleg varchar(max)
as 
begin


SET @SQLString = "SELECT *
    FROM table1
    WHERE  items in (@item)";


DECLARE @SQLString nvarchar(500);
DECLARE @ParmDefinition nvarchar(500);

SET @ParmDefinition = "@item varchar(max)";


EXECUTE sp_executesql
    @SQLString
    ,@ParmDefinition
    ,@item = @privilleg

end

u can pass this way the parameters to proc

SqlConnection con = new SqlConnection(conStr);
SqlCommand cmd = new SqlCommand("SP_SAVE_EMP", con);
cmd.CommandType = CommandType.StoredProcedure;
cmd.Parameters.AddWithValue("@EMPCODE", code);
cmd.Parameters.AddWithValue("@NAME",name);
cmd.Parameters.AddWithValue("@AGE", age);
cmd.Parameters.AddWithValue("@DOB", name);
cmd.Parameters.AddWithValue("@EMAIL", email);
cmd.Parameters.AddWithValue("@IMAGE", image);
con.Open();
status = (int)cmd.ExecuteNonQuery();