sql防止注入 like 和 in 应该怎么写

这是in的写法

public List ins(String ids){
    String where = " where 1=1";
    List<String> wlist  = new ArrayList();
    String tms = "";
    if(ids!=null){
        String[] s = ids.split(",");
        for(int i = 0;i<s.length;i++){
            if(i==0){
                tms+="?";
            }else{
                tms+=",?";
            }
            wlist.add(s[i]);
        }
        where+=" and id in("+tms+")";
    }
    String sql = "select * from t_project "+where;
    List tlist = jdbcTemplate.queryForList(sql,wlist.toArray());
    System.out.println(""+tlist.size());
    return tlist;
}

这是like 的写法

String where = " where 1=1 ";

List<String> wlist  = new ArrayList();
if(projectName!=null){
    where+=" and project_name like ?";
    wlist.add("%"+projectName+"%");
}