PreparedStatement传in(?)中参数

若是直接往in(?)中传入字符串str="‘a’,‘b’"，那么sql就会把str看成一个值

select * from table1 where id in ("'a','b'");

但是我要的是传入2个值，一个是"a"，一个是"b"

select * from table1 where id in ('a','b');

最后决定在sql中就拼接进str

String str="'a','b'";
String sql = "select * from table1 where id in ("+str+")";
PreparedStatement pstmt=con.prepareStatement(sql);
pstmt.executeQuery();