All the examples of an SQL injections that I've seen have a user controlled string
variable that was directly used to construct the SQL query but, I was wondering if it's possible to perform an SQL injection provided that the variable userNumber
is a long
and is user-controlled in the following query.
sqlQuery='SELECT * FROM custTable WHERE UserNumber=' + UserNumber;
I understand that using a parameterized query is the best option to prevent an SQL injection attack but I'm asking this out of curiosity.