diff --git a/servers/login.cgi b/servers/login.cgi
index 3272c0420..02ac5a56c 100755
--- a/servers/login.cgi
+++ b/servers/login.cgi
@@ -11,6 +11,7 @@ our (%in);
 &ReadParse();
 my $enc = &encode_base64($in{'user'}.":".$in{'pass'});
 $in{'id'} =~ s/\r|\n|\0//g;
+$in{'id'} =~ /\A[0-9]+\z/ || &error("Invalid server ID");
 $enc =~ s/\r|\n|\0//g;
 print "Set-Cookie: $in{'id'}=$enc; path=/";
 if (uc($ENV{'HTTPS'}) eq 'ON') {
diff --git a/servers/logout.cgi b/servers/logout.cgi
index bef8977bc..6c5a9d3f4 100755
--- a/servers/logout.cgi
+++ b/servers/logout.cgi
@@ -10,6 +10,7 @@ require './servers-lib.pl';
 &ReadParse();
 our (%in);
 $in{'id'} =~ s/\r|\n|\0//g;
+$in{'id'} =~ /\A[0-9]+\z/ || &error("Invalid server ID");
 print "Set-Cookie: $in{'id'}=; path=/";
 if (uc($ENV{'HTTPS'}) eq 'ON') {
 	print "; secure";