Inurl Index.php%3fid= -

The most effective defense against SQL Injection is the use of prepared statements. Parameterization ensures that the database engine treats user input strictly as data, never as executable code.

https://example.com/index.php?id=123

Consider using a WAF to help detect and prevent common web exploits. inurl index.php%3Fid=