title: is it safe to use java.text.MessageFormat.format() when creating an sql query?
body: <p>I am using <strong>MessageFormat.format()</strong> to create the String for my PreparedStatement. I read that using <strong>StringBuilder</strong> may be a cause of sql injection. Is it the same for MessageFormat?</p>
  
  <p>the code goes like this </p>
  
  <pre><code>String SQL
          = "select CT.SYS_CHANGE_OPERATION, CT.{0} as ID, t.*\n"
          + "from changetable (changes {1}, ?) as CT \n"
          + "left outer join {2} as t \n"
          + "on t.{3} = CT.{4} \n"
          + "order by CT.SYS_CHANGE_VERSION";
  
  String finalSQL = MessageFormat.format(SQL, primaryKey, table, table, primaryKey, primaryKey);
          PreparedStatement pstmt = con.prepareStatement(finalSQL);
  </code></pre>