That's most of it: the most common exploits are where someone would shove a quote into a query parameter (e.g. http://example.org/foo/bar/?id=%27%3BINSERT%20INTO%E2%80%A6) to see if you were just concatenating strings.

You can go further by actually validating types (e.g. “id should be a number between 1 and 20 digits”) but I'd class that more as general input validation since you want to do that everywhere even if you don't have SQL database.