The number of combinations doesn't come into play. At worst, you'd have to do 20 SELECT statements to find out if all elements are contained in the table. If the table gets large, you'll want to make sure that the table has an index that can be (and actually gets) used for the SELECT.
Any ORM/JDBC will have a mechanism for creating queries.
Be *very* cautious about using the code above as given, however, unless you've already made sure the variables being used to create the query are cleaned of anything that can be used to create an SQL injection attack.