I'm gonna say that it depends on what you do later with the ID variable. If your code later converts the hex to a string and then builds queries with it, then the answer becomes 'yes'
I build an e-commerce website that looks looks up your purchase history based on your customer ID... Being a noob, I came up with a clever idea of using your email address to generate your ID by simply converting it to hexadecimal.
- my email =
- my ID would then be =
That looks like a "pretty secure" and unique ID, so I feel really good about what I've done.
Now the injection:
Someone figures out that the user ID is simply the hex equivalent of the email address and guesses that I may be converting it back into text and using that result in a query
If I, the developer, check to make sure the ID is numeric... then hex-to-text the ID... then use it in a query.... I've just allowed a sql injection
Here's a similar question regarding SQL injections using only alpha-numeric characters: http://stackoverflow.com/questions/8086906/keeping-clear-of-sql-injections
Here's another thread discussing sql injection via hex: http://arstechnica.com/civis/viewtopic.php?f=20&t=107657
... Of course the right solution is to use 'real' prevention mechanisms such as parameterized queries, but this is certainly an interesting question.