mybatis零配置，@Select或者SelectProvider如何复用查询列

*Mapper.xml中的用法

  <sql id="Base_Column_List" >
    c_bh, c_mc, d_fbrq, d_ssrq, d_create, d_update
  </sql>
  <select id="selectByPrimaryKey" resultMap="BaseResultMap" parameterType="java.lang.String" >
    select 
   <include refid="Base_Column_List" />
    from t_fl
    where c_bh = #{cBh,jdbcType=VARCHAR}
  </select>

mybatis零配置，@Select或者SelectProvider如何复用查询列，达到上边xml中的效果？

 public interface UserMapper {
     @SelectProvider(type = SqlProvider.class, method = "selectUser")
     @ResultMap("userMap")
     public User getUser(long userId);
}

 public class SqlProvider {
     public String selectUser(long userId) {
         return "select * from user where userId=" + userId;
     }
 }

不用"?"来替代吗？ 你这样会sql注入