Is it safe to not parameterize an SQL query when the parameter is not a string?

I think it’s safe… technically, but it’s a terrible habit to get into. Do you really want to be writing queries like this?

var sqlCommand = new SqlCommand("SELECT * FROM People WHERE IsAlive = " + isAlive + 
" AND FirstName = @firstName");

sqlCommand.Parameters.AddWithValue("firstName", "Rob");

It also leaves you vulnerable in the situation where a type changes from an integer to a string (Think employee number which, despite its name – may contain letters).

So, we’ve changed the type of EmployeeNumber from int to string, but forgot to update our sql queries. Oops.