filter sql injection

[andz]

i've got a ready-made script that's uses many POST and GET to process request.

 

I discovered an SQL injection using url. it successully executed this code and return the mysql version which is 4.1.22

 

here's the code: http://example.com/process.php?id=123456 union all select 1, @@version/*

 

is there a way to filter the POST and GET to prevent this attack?

 

 

[trq]

filter.

[waynew]

Make sure that what is coming in is a number.

 

if(!isset($_GET['id']) || intval($_GET['id']) == 0){
header('Location: index.php');
exit;
}
else{
//handle url and display page
}