1、通过转换string到字符数组，循环比较字符是否相等。

public static Integer getCount(){
        String sql="update user SET user_name=?,age=?,sex=?password=? WHERE id=?";
        Integer count = 0;
        char[] chars = sql.toCharArray();
        for (int i = 0; i <chars.length ; i++) {
            char aChar = chars[i];
            if(aChar == '?'){
                count++;
            }
        }
        return count;
}

2、通过字符串长度来统计。

 public static Integer getCount(){
        String sql="update user SET user_name=?,age=?,sex=?password=? WHERE id=?";
        Integer size;
        int begin = sql.length();
        String s = sql.replaceAll("\\?", "");
        int end = s.length();
        size = begin - end;
        return size;
}

批量替换字符串中单个字符

String s = sql.replaceAll("\\?", "1");
System.out.println(s);