I've had up to 30-40 placeholders (the ?s) without a problem. As the JDBC API is mainly a set of interfaces, it may be defined by the underlying driver implementation. Try writing some quick test code and you should find your answer.
Evildoers! Eat my justice! And this tiny ad's justice too!