If you feel the need (sorry, one of us had to) …
I would do as you say, have an apply button that steps through all the selected checkboxes (with a “are you sure?” box before performing the DB update). I don’t like people updating databases in “real time” without some form of confirmation, even on single selections.
I would make the apply button step through each control, so something like this on the “master” form (pseudo code) :
for p in self.repeating_panel_1.get_components():
if p is Type(Checkbox):
if p.checkbox.selected == True:
# store the ID in an array.
(edit - I know you’re not using repeating panel, so just step through your main form instead)
Then at the end send all the IDs in the array to the server where you can validate the request.
The “Select all” would do something similar setting the checked values.
If the user can make choices, then a malicious user can do so too. That’s not really SQL injection though in its commonly understood form (which is tricking the server into performing an unauthorised action through carefully scripted SQL parameters). All updates, even single clicks, must be validated so an en masse update is really no different other than in its scope.