SQL Injection with long data type

Question

All the examples of an SQL injections that I've seen have a user controlled string variable that was directly used to construct the SQL query but, I was wondering if it's possible to perform an SQL injection provided that the variable userNumber is a long and is user-controlled in the following query.

sqlQuery='SELECT * FROM custTable WHERE UserNumber=' + UserNumber;

I understand that using a parameterized query is the best option to prevent an SQL injection attack but I'm asking this out of curiosity.

Answer 1

The result will rely mostly on how your backend (application code not DB) behaves. If the application cast() or rejects everything but longs (or ints or whatever numeric types) there is simply no chance you can conduct a successful injection.

If your application doesn't sanitize user input your example could be SQL injectable:

sqlQuery='SELECT * FROM custTable WHERE UserNumber=' + 22 UNION SELECT ...;