Below is the following pseudo-code:

public  updated(int id) {

  // Note that variable **id** is not surrounded by single/double quotes. 

  sql = "Update table user set status=2 where user_id=**id** ";  

  // execute command

Is this vulnerable to SQL injection ( Arithmetic SQL injection perhaps) ?

  • 2
    No, SQL injection is not possible in this case
    – paj28
    Commented Nov 11, 2016 at 12:36
  • 4
    As long as this is a language which enforces types, it should be safe. If the "int" is considered a type hint which can be ignored, might not be. However, this would be unusual...
    – Matthew
    Commented Nov 11, 2016 at 13:12
  • 4
    While this isn't vulnerable, I'd still ditch this style of building queries in favour of parameterized queries. Commented Nov 11, 2016 at 13:14

2 Answers 2


No, your query expects an integer and is guaranteed to get one. An SQL injection vulnerability only emerges when an attacker can supply unexpected data that would alter the query. Different integers don't influence the syntax. But as soon as you stop enforcing the type it becomes unsafe.

As @CodesInChaos remarked, if you are the author of this snippet you should consider using parametrized queries instead. That way the supplied type becomes irrelevant which is easier to audit and harder to break by accident.


There are no known techniques for performing SQL injections via integers. But note that non-integer numbers are vulnerable to SQL injection in some cases via Lateral SQL Injection. Its not clear if integers will remain safe forever.

As other answers have mentioned - use parameterized queries even for numbers and dates.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .