Is it safe to not parameterize an SQL query when the parameter is not a string?

Question

In terms of SQL injection, I completely understand the necessity to parameterize a string parameter; that's one of the oldest tricks in the book. But when can it be justified to not parameterize a SqlCommand? Are any data types considered "safe" to not parameterize?

For example, I don't consider myself anywhere near an expert in SQL, but I can't think of any cases where it would be potentially vulnerable to SQL injection to accept a bool or an int and just concatenate it right into the query.

Is my assumption correct, or could that potentially leave a huge security vulnerability in my program?

For clarification, this question is tagged c# which is a strongly-typed language; when I say "parameter," think something like public int Query(int id).

Answer 1

Use the below query:

var sqlCommand = new SqlCommand("SELECT * FROM People WHERE IsAlive = " + isAlive + " AND FirstName = @firstName");

sqlCommand.Parameters.AddWithValue("firstName", "Rob");

In the above query, the type of EmployeeNumber is changed from int to string.