php - 18,000 MySQL injection attempts per day: Stopping the attempts -

this question not protecting against sql injection attacks. question has been answered many times on stackoverflow , have implemented techniques. stopping attempts.

recently site has been hit huge numbers of injection attacks. right now, trap them , return static page.

here's url looks like:

/products/product.php?id=1 

this attack looks like:

/products/product.php?id=-3000%27%20in%20boolean%20mode%29%20union%20all%20select%2035%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c%27qopjq%27%7c%7c%27ijijvkybho%27%7c%7c%27qhwnq%27%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35%2c35--%20 

i know sure isn’t bad link or fat-fingered typing don't want send them overview page. don’t want use resources on site delivering static pages.

i’m considering letting page die die(). there wrong approach? or there html return code can set php more appropriate?

edit:

based on couple of comments below, looked how return 'page not found'. stack overflow answer icktoofay suggests using 404 , die(); - bot thinks there isn’t page , might go away, , no more resources used display page not found message.

header("http/1.0 404 not found"); die(); 

filtering out injection attempts mod_security for.

it can take quite bit of work configure recognize legitimate requests app.

another common method block ip addresses of malicious clients when detect them.