StringBuilder sql = new StringBuilder("select ID,COMMAND,DESCRIPTION,CONTENT from message where 1=1");

List<String> paramList = new ArrayList<String>();

if(command != null && !"".equals(command.trim())){

 sql.append(" and COMMAND=?");

 paramList.add(command); } 

 报错：You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '? '%'' at line 1 

写这个的时候报语法错误，请问要怎么改呢