如何把sql和参数拼接在一起

		//传入sql语句
		StringBuilder sqlOld=new StringBuilder(
				"SELECT decode(zxjkl, '0', '0', num / zxjkl) AS code\n" +
				"  FROM (SELECT SUM(zxjkl) zxjkl\n" + 
				"          from (select nvl(zxjkl, '0') zxjkl, b.ryid\n" + 
				"                  from (SELECT STDDEV(y.zljkzfs) * STDDEV(y.zljkzfs) * ？ * ？ / ？ / ？ AS zxjkl,\n" + 
				"        zljkywdjr AS ryid FROM ywgl_zljk y WHERE   zljkpfsj >= add_months(to_date(?,'yyyy-MM'),-2)\n" + 
				"    AND zljkpfsj <= add_months(to_date(?,'yyyy-MM'),0)\n" + 
				"                  group by zljkywdjr) a,\n" + 
				"                (select bzryrybh ryid\n" + 
				"                   from pb_bzb a, pb_bzry b\n" + 
				"                  where a.bzbbh = b.bzrybzbh\n" + 
				"                    and cyjxbj = '1') b\n" + 
				"          where a.ryid(+) = b.ryid)\n" + 
				"\n" + 
				" ) a,\n" + 
				"(SELECT nvl(SUM(FZNJKSL), '0') AS num\n" + 
				"   FROM zljk_jkjh\n" + 
				"  WHERE jhsj = ？) b");
		sqlOld.append("####");
		String sql=sqlOld.toString();
		//参数
		StringBuilder paramOld2=new StringBuilder("[1, 1, 1, 1, 2018-03, 2018-03, 2018-03]".toString());
		String paramOld=paramOld2.toString();
		String param=paramOld.substring(1, paramOld.length()-1);
		String[] sqlList=sql.split("\\?");
		String[] paramList=param.split(", ");
		String sqlNew=sqlList[0];
		if ((sqlList.length-1)==paramList.length) {
			for (int i = 0; i < paramList.length; i++) {
				sqlNew+="'"+paramList[i]+"'"+sqlList[i+1];			
			}
		}
		sqlNew=sqlNew.substring(0,sqlNew.length()-4);
		System.out.println(sqlNew);