title: Is it safe to not parameterize an SQL query when the parameter is not a string?
body: <p>In terms of <a href="https://en.wikipedia.org/wiki/SQL_injection">SQL injection</a>, I completely understand the necessity to parameterize a <code>string</code> parameter; that's one of the oldest tricks in the book. But when can it be justified to <em>not</em> parameterize an <code>SqlCommand</code>? Are any data types considered "safe" to not parameterize? </p>
  
  <p>For example: I don't consider myself anywhere <em>near</em> an expert in SQL, but I can't think of any cases where it would be potentially vulnerable to SQL injection to accept a <code>bool</code> or an <code>int</code> and just concatenate it right into the query.</p>
  
  <p>Is my assumption correct, or could that potentially leave a huge security vulnerability in my program?</p>
  
  <p><em>For clarification, this question is tagged <a href="/questions/tagged/c%23" class="post-tag" title="show questions tagged &#39;c#&#39;" rel="tag">c#</a> which is a strongly-typed language; when I say "parameter," think something like</em> <code>public int Query(int id)</code>.</p>