sql防止注入 like 和 in 应该怎么写

这是in的写法

public List ins(String ids){    String where = " where 1=1";    List<String> wlist  = new ArrayList();    String tms = "";    if(ids!=null){        String[] s = ids.split(",");        for(int i = 0;i<s.length;i++){            if(i==0){                tms+="?";            }else{                tms+=",?";            }            wlist.add(s[i]);        }        where+=" and id in("+tms+")";    }    String sql = "select * from t_project "+where;    List tlist = jdbcTemplate.queryForList(sql,wlist.toArray());    System.out.println(""+tlist.size());    return tlist;}

这是like 的写法

String where = " where 1=1 ";

List<String> wlist  = new ArrayList();if(projectName!=null){    where+=" and project_name like ?";    wlist.add("%"+projectName+"%");}