Ensure SQL injection does not show the whole data set

I have been receiving the SQL injection issue again. Is there a way that if SQL is injected (i.e. it does not match an Id in the database) that we can provide an error page of some sort? Even though this doesn't pose a security issue like the scan indicates, it'd at least (hopefully) make the finding go away. Let's discuss it further at our next standup. Some of the URLs the scans pointed out are:
https://dev1.ea.gsa.gov/api/systems/get/4%20OR%2017-7%3d10/records
https://dev1.ea.gsa.gov/api/systems/get/4%20OR%2017-7%3d10/capabilities
https://dev1.ea.gsa.gov/api/systems/get/4%20OR%2017-7%3d10/time
https://dev1.ea.gsa.gov/api/systems/get/4%20OR%2017-7%3d10/technologies
https://stage.ea.gsa.gov/api/it_standards/get/7302%20OR%2017-7%3d10
https://stage.ea.gsa.gov/api/systems/get/773%20OR%2017-7%3d10/capabilities
https://stage.ea.gsa.gov/api/systems/get/773%20OR%2017-7%3d10/records
https://stage.ea.gsa.gov/api/systems/get/773%20OR%2017-7%3d10/technologies
https://stage.ea.gsa.gov/api/it_standards/get/7302%20OR%2017-7%3d10/systems
https://stage.ea.gsa.gov/api/systems/get/773%20OR%2017-7%3d10/time
https://dev1.ea.gsa.gov/api/it_standards/get/7016%20OR%2017-7%3d10/systems
https://dev1.ea.gsa.gov/api/it_standards/get/7016%20OR%2017-7%3d10
https://dev1.ea.gsa.gov/api/fisma/get/1%20OR%2017-7%3d10
https://stage.ea.gsa.gov/api/fisma/get/1%20OR%2017-7%3d10
https://dev1.ea.gsa.gov/api/websites/get/5%20OR%2017-7%3d10/
https://dev1.ea.gsa.gov/api/websites/get/5%20OR%2017-7%3d10/scans