title: Integer and protection against injection
body: <p>Im using nodejs. When creating a vanilla sql query I have this:</p>
  
  <pre><code>var id = req.body.id;
  var query = "select from table where id = " + id;
  </code></pre>
  
  <p>Now, what I knew is that you should escape integer this way:</p>
  
  <pre><code>var id = parseInt(req.body.id);
  </code></pre>
  
  <p>Is that correct? Or you should escape like a string? Or not escape at all?  </p>