I've had up to 30-40 placeholders (the ?s) without a problem. As the JDBC API is mainly a set of interfaces, it may be defined by the underlying driver implementation. Try writing some quick test code and you should find your answer.
Grow a forest with seedballs and this tiny ad:
a bit of art, as a gift, that will fit in a stocking