Since it appears that GetAllPersonAvatarId is only used by this controller (and thus could be changed without impacting anything else), rather than joining all these into a big string just to pass it in and have it split back up again, how about just passing avatarIdList to the action.  Then the action could hand the request parameter directly to Hibernate's setParameter call.