title: How to remove URL injection by parameter en masse?
body: <p>My (wordpress) site was recently the victim of an attack...ended up with around 20,000 injected URLs. I've since cleaned up the site completely, plugged all the holes, and have installed further hardened the files, but I'm still left with all these URLs in the google index &amp; a message on Google that says "This site may be hacked" because of all these spammy URLs. It's just not realistic to be able to go through &amp; add them to the Webmasters URL Remove tool. I've heard the best way is to get them to display 404 (or 403) and they'll naturally fall out of the index.</p>
  
  <p>Here's what I'd like to do, but haven't figured out how to do it yet: I'd like to come up with a way to force any URL with a certain parameter to display a 404 or 403. For example, the below URL is a good representation of the URLs that are currently indexed:</p>
  
  <p><a href="http://mysiteurlhere.com/index.php?free-online-games-with-cash-prizes.html&amp;items=2&amp;pidnum=1568" rel="nofollow">http://mysiteurlhere.com/index.php?free-online-games-with-cash-prizes.html&amp;items=2&amp;pidnum=1568</a></p>
  
  <p>Both "items" &amp; "pidnum" are parameters that are used in every single indexed URL that I've seen. My question is: would it be possible to single out one of those parameters with some sort of .htaccess statement, and block or force the URL to 404? </p>
  
  <p>(note: I did go through the robots.txt to disallow any further URLs with parameters like these from being indexed...I just don't know how to do the .htaccess method)</p>