SpringMVC中post checkbox 多选框value的值（隐藏域方式）

我这里往后端传递checkbox 多选框value的值是通过字符串方式传递，先调用js对选定checkbox遍历获取选的的boxvalue，然后写进隐藏域，最后作文对象的属性提交。见代码：`

前端：

<form:form commandName="user" method="post">
                    <c:forEach items="${deploys}" var="deploy" varStatus="deployStatus">
                        <input type="checkbox" name="checkbox" value="${deploy.id}"/>${deploy.systemName}
                        <br>
                    </c:forEach>
                    <spring:bind path="id">//实际存储的值，此处隐藏
                        <div class="form-group" hidden>
                            <form:input path="id" name="id" cssClass="form-control"></form:input>
                        </div>
                    </spring:bind>
                    <spring:bind path="accessControl">//实际存储的值，此处隐藏
                        <div class="form-group" hidden>
                            <form:input path="accessControl" name="accessControl" cssClass="form-control"></form:input>
                        </div>
                    </spring:bind>
                    <input type='button' value='确定' onclick="fun()"/>//调用脚本，给需要post的数据赋值
                    <div class="form-group">
                        <button type="submit" class="btn btn-primary">保存</button>
                        <a class="btn btn-success pull-right" href="/user/list">返回</a>
                    </div>
 </form:form>

脚本

<script type="text/javascript">
    function fun() {
        var boxes = document.getElementsByTagName("input");
//        var val = []
        var str = "";
        for (var i = 0; i < boxes.length; i++) {
            if (boxes[i].name == "checkbox" && boxes[i].checked == true) {
//                val.push(boxes[i].value);
                str += boxes[i].value + ',';
            }
        }
        $("#accessControl").val(str)
//        alert(atr);
//        alert(val);
    }
</script>

后端;

 @RequestMapping(value = "editaccesscontrol", method = RequestMethod.POST) //后端方法，
    public String editAccessControlPost(User user,ModelMap model ) {//接收参数对象user
        userMapper.updateUserAccessControl(user);
        model.addAttribute("user",user);
        model.addAttribute("success", "权限修改成功");
        return "redirect:/user/editaccesscontrol?id="+user.getId();
    }