how to pass values to IN keyword in sql query from front end

using System;
using System.Data;
using System.Configuration;
using System.Collections;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;

using System.Data.Sql;
using System.Data.SqlClient;
using System.Data;
using System.Data.Common;

public partial class test : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {
        using (SqlConnection sqlCon = new SqlConnection(@"Data Source=127.0.0.1; Database=DatabaseName; User id=uid; Password=pwd; Integrated security=true;"))
        {
            sqlCon.Open();

            SqlCommand sqlCmd = new SqlCommand("usp_data", sqlCon);
            sqlCmd.CommandType = CommandType.StoredProcedure;
            
            sqlCmd.Parameters.Add(new SqlParameter("@vals", "2,3,4,5"));
            //OR
            sqlCmd.Parameters.Add(new SqlParameter("@vals", "A,B,C,D"));

            int recAffected = sqlCmd.ExecuteNonQuery();

            sqlCon.Close();
        }
    }
}

use [DatabaseName]
go

create procedure [dbo].[usp_data]
	@vals varchar(max)=null
as	
BEGIN
	declare @str varchar(max)
	declare @vals varchar(max)
	
	-- for numeric values
	set @str = 'select * from tbl_data where id in(' + @vals + ')'
	print @str
	exec (@str)
	
	-- for text values
	set @vals = replace(@vals, ',', char(39)+','+char(39))
	set @str = 'select * from tbl_data where id in(' + char(39) + @vals + char(39) + ')'
	print @str
	exec (@str)
END