I don't think we're specifically vulnerable here, but best to add an explicit int cast when concatenating values into SQL.