I think you might have misunderstood my comment even on the second reply after the ruder version you deleted: validation at edge is exactly what I was suggesting. If you're writing your code assuming a numeric ID, using placeholders means that it won't be exploitable if someone submits a non-numeric value but you're still at risk as described and likely other problems. If you validate it immediately and send an HTTP 400 for anything which isn't a valid number in whatever range you support, you don't have to worry about later finding out that someone came up with a clever way to do XSS, log splitting, etc. attacks even if they couldn't get at the database directly.