Possible SQL injection. How to locate and fix?

Possible SQL injection. How to locate and fix?