title: Java enum values and SQL injection
body: <p>I have the following enum:</p>
  
  <pre><code>public enum AccountStatus {
  
      ENABLED,
      CONFIRMATION_PENDING,
      EXPIRED,
      LOCKED,
      DISABLED,
      CREDENTIALS_EXPIRED,
  }
  </code></pre>
  
  <p>That I'm binding to checkboxes in a JSP form:</p>
  
  <pre><code>&lt;li&gt;&lt;form:checkbox path="accountStatus" value="ENABLED" label="Enabled" /&gt;&lt;/li&gt;
  &lt;li&gt;&lt;form:checkbox path="accountStatus" value="CONFIRMATION_PENDING" label="Confirmation Pending" /&gt;&lt;/li&gt;
  ...
  &lt;li&gt;&lt;form:checkbox path="accountStatus" value="CREDENTIALS_EXPIRED" label="Credentials Expired" /&gt;&lt;/li&gt;
  </code></pre>
  
  <p>In my controller when I get the selected checkbox values I convert the String to an Enum as follows:</p>
  
  <pre><code>AccountStatus accountStatus = AccountStatus.valueOf("selected string here");
  </code></pre>
  
  <p>Then in my DAO (using Spring JdbcTemplate) I query my database using the selected values:</p>
  
  <pre><code>String SQL = "SELECT * FROM TABLE_A WHERE column = \'" + accountStatus.name() + "\'";
  
  jdbcTemplate.query(SQL, new MyMapper());
  </code></pre>
  
  <p>Since I'm validating each user selected checkbox by using <code>AccountStatus.valueOf(...)</code>, is this way of doing safe from SQL injection?</p>