sql injections are the results of badly written code - for example public forms saving to the database, or search forms without any kind of special character escapes. I'm not an expert at programming but you should look at these functions if you are using php:
http://php.net/manual/en/function.my...ape-string.php
http://php.net/manual/en/function.htmlspecialchars.php

Good luck!