mysql直接拼接in_mysql in函数拼接条件问题

String[] orderIds = query.getOrderId().split(",");

StringBuffer buffer = new StringBuffer();

for (String orderId : orderIds) {

buffer.append(orderId).append(",");

}

buffer.deleteCharAt(buffer.length() - 1);

String sql = "select order_id,pay_status from order_info where order_id in ("+buffer.toString()+")";

List list = jdbcService.queryEntityList(OrderInfoTo.class,sql);

抛出异常：

PreparedStatementCallback; bad SQL grammar [select order_id,pay_status from order_info where order_id in (170606100349,170606100376,170606100396)]; nested exception is com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Unknown column 'ys170606100349' in 'where clause'

这种方法一直在用，都没有抛过异常，突然今天我在另一个需求做的时候使用这种方法查询，突然抛异常了，怎么解决，原因是什么