Q:

Parameterized sql queries with JDBC template

I'm running into a problem where my parameterized queries with a single parameter will run fine, but when inserting more than one parameter, it doesn't work. 
The following method works fine:
public Employee getEmployeeByID(int id) {
    String sql = "SELECT firstname, lastname FROM employees WHERE employeeID = ?"; 
    List<Employee> list = getEmployeeList(sql, id);
    if (list.isEmpty()) {
        return null;
    }
    return list.get(0);
}

Here is getEmployeeList, which it depends on:
private List<Employee> getEmployeeList(String sql, Object... params) {
    List<Employee> list = new ArrayList<Employee>();
    for (Object o : template.query(sql, mapper, params)) {
        list.add((Employee) o);
    }
    return list;
}

Note that template is an autowired JDBCTemplate, and mapper is an autowired RowMapper. 
However, this method isn't working at all:
public List<Employee> getEmployeesBySearchCriteria(String criteria) {

    //business logic that determines the values
    //of Strings firstname, lastname, and keyword...

    String sql = "SELECT firstname, lastname FROM employees WHERE UPPER(firstname) LIKE UPPER('%?%') ?  UPPER(lastname) LIKE UPPER('%?%')";

    return getEmployeeList(sql, firstname, keyword, lastname);

}

I'm getting the following error:
java.sql. SQLException: Parameter index out of range (2 > number of parameters, which is 1). 

I understand that I could just manually append each string into the sql statement, but I'm concerned about sql injection, and I can't figure out why this isn't working.   Is there a problem with my syntax?   Or am I going about this completely wrong? 

A:

You can't use ?  like that '%?%'  in a like condition.  You need to remove the % and append them to your string.  For instance :
public List<Employee> getEmployeesBySearchCriteria(String criteria) {

    String sql = "SELECT firstname, lastname FROM employees WHERE UPPER(firstname) LIKE UPPER(?)"; 

    return getEmployeeList(sql, "%" + firstname + "%");

}

