Use param_integer not param_variable for id

htdocs/admin/deletemenuitem.json.php

@@ -28,7 +28,7 @@ define('INTERNAL', 1);
 define('ADMIN', 1);
 require(dirname(dirname(__FILE__)) . '/init.php');
 
-$itemid = param_variable('itemid');
+$itemid = param_integer('itemid');
 
 if (!delete_records('site_menu','id',$itemid)) {
     json_reply('local', get_string('deletefailed','admin'));