List<String> paramList = new ArrayList<String>();
            if (command != null && !"".equals(command.trim())) {
                sql.append("and COMMAND=?");
                paramList.add(command);
            }
            if (description != null && !"".equals(description.trim())) {
                sql.append("and DESCRIPTION like '%'?'%'");
                paramList.add(description);
            }

            PreparedStatement statement = conn.prepareStatement(sql.toString());

            for (int i = 0; i < paramList.size(); i++) {
                statement.setString(i + 1, paramList.get(i));
            }

            ResultSet rs = statement.executeQuery();

控制台报错如下：

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'COMMAND='??????'and DESCRIPTION like '%''??????''%'' at line 1