If you want to bind parameters you have to put as many question marks in IN clause as your parameters count, ie:
and then bind one by one all three parameters to PreparedStatement.
You have to know parameters count before creating PrepareStatement (but you can still create dynamically SQL
String with required question marks count for PreparedStatement).