The type of argument there should play no role in SQL injection other then how the SQL query is formed in the first place.
SQL injection abuses a SQL query being created from the parameter as a string. Web server treats the whole URL as a string and parses all the parameters as string as well. So even when the id is numeric, such as 1, it is treated by a web server as string and the code then inserts it as a string. This allows you to insert special characters, which would not be possible if only numbers were allowed.
However, there may be difference in the SQL query. When using string in a SQL query, the string has to be enclosed in single quotes
'. Numbers can, but don't have to be.
SELECT * FROM Test WHERE id = $NUMBER;
SELECT * FROM Test WHERE id = '$TEXT';
When you have a string enclosed in quotes, you have to close the quotes first. So for example you would send
A'; DROP TABLES *;-- which would give you:
SELECT * FROM Test WHERE id = 'A'; DROP TABLES *; --'.
You can see the
' finishing the first
' so that your
DROP TABLES *; command is treated as a command and not as text. The -- is used for comments in SQL and here we use it to get rid of the closing
'. Otherwise, it would cause a malformed SQL query.
Please note that numbers CAN also use quotes in a query, so using this escaping method may be useful to try even if the site only uses numbers in the parameter. Also, depending on the SQL engine, other types of quotes then single quotes, such as double quotes may be usable, which would change how you have to escape them.