No, when in uses parameters, the parameter type will be forced to be consistent with the conditional field, and string construction is not supported (if the field itself is of varchar or char type, in is only equivalent to a conditional value, not a group).

You can use exec to execute the whole sql as a parameter, such as

exec(' SELECT * FROM table WHERE id IN('+@ ids+')')

But I feel that this is actually no different from directly constructing sql statements, and it can't prevent injection.