lucy24 - 10:59 pm on Nov 23, 2013 (gmt 0)
it also responds with an "Invalid Product id" type message rather than a 404.
Those aren't mutually exclusive. You need to distinguish between what a human sees -- which can be absolutely anything -- and the server response header. If a search engine asks for a garbage URL, it needs to get a 404. Otherwise it just thinks you have a bunch of identical pages.* Conversely, if your php-or-similar script returns a 404 header, you also need to include some form of the physical 404 page, because it won't happen automatically.
I also have one soft 404. It apparently, if I understand the message correctly, is caused by a strange link from someone else
Nobody else can "cause" a soft 404. It happens within your own site. You wouldn't be the first person to be confused by the terminology, though. The expression "soft 404" is google's way of describing a request that should lead to a "no such page" 404 but instead gets a redirect (301/302 followed by 200) to some other page. You typically see this in sites that redirect all bad requests to the home page.
* I recently found this illustrated in a pretty entertaining way when I tried one of those "similar pages" tools. I fed in two URLs and was told they were 100% identical. This would be because, er, both requests led to my 403 page (online tools, by their nature, live on server farms). Unblock the IP and all was well.