Java代码里如何拼接SQL语句到mybatis的xml

StringBuilder whereSql = new StringBuilder();
whereSql.append("SQL");

	public List getList(Map<String, Object> map) {
		List<Map<String, Object>> rs = new ArrayList<Map<String, Object>>();
		try {
			StringBuilder whereSql = new StringBuilder();
 
			if (map.get("userName").toString().length()>0) {
				whereSql.append(" AND a.userName in ('" + map.get("userName").toString().replaceAll(",", "\',\'") + "')");//不为空时加入查询条件
			}
			if (map.get("CURRENTPAGE").toString().length()>0 && map.get("PAGESIZE").toString().length()>0) {//前端有传分页参数时就添加分页查询条件
				int currenpage = Integer.parseInt(map.get("CURRENTPAGE").toString());
				int pagesize = Integer.parseInt(map.get("PAGESIZE").toString());
				currenpage = ((currenpage - 1) * pagesize);
				whereSql.append(" limit " + currenpage + "," + pagesize);
			}
 
			rs = wmTblWorkorderMapper.getList(whereSql.toString());
			return rs;
		} catch (Exception e) {
			e.printStackTrace();
		}
		return null;
	}

List<Map<String,Object>> getList(@Param("whereSql") String whereSql);

<select id="getList" resultType="HashMap">
 SELECT * FROM user a WHERE 1=1 ${whereSql}
</select>