code: public static String substitute(String sql, Object... params) {
          try {
              if (params == null || params.length == 0)
                  return sql;
              String subst = sql;
              int start = 0;
              int q;
              for (int i = 0; start < subst.length() && (q = subst.indexOf('?', start)) >= 0; i++) {
                  Object param = params[i];
                  String p = String.valueOf(param);
                  if (param != null && !(param instanceof Integer) && !(param instanceof Long))
                      p = "'" + p + "'";
                  subst = subst.substring(0, q) + p + subst.substring(q + 1);
                  start = q + p.length();
              }
              return subst;
          }
          catch (Throwable t) {
              logger.severeException(t.getMessage(), t);
              return sql;
          }
      }
docs: Utility method for showing parameterized query result