If your developer used mysql_query("SELECT * FROM products WHERE id = " . $_GET['id']) anywhere in your codebase, your shop is not a store—it is a library book with the "steal me" sticker already attached.
Here is the step-by-step defense strategy:
In the case of the "inurl index php id 1 shop" pattern, the vulnerability arises when an attacker manipulates the ID parameter to inject malicious SQL code. For example, an attacker might modify the URL to index.php?id=1' OR '1'='1 , which would allow them to bypass authentication mechanisms or extract sensitive data from the database.
If the developer has not sanitized the input (cleaned the data), the server blindly trusts whatever is placed after id= . A hacker can see this URL structure and attempt to manipulate the database.