I didnt know SA-MP servers could get sql injections wow
Everything that uses input from the user is subjective to SQL Injections. In a SA:MP server you use dialogs, commands etc. Even your name can be an SQL inject command (of only 24 chars long though).
mysql_real_escape_string() is the first command that you can use and another would be something like add_slashes (PHP) to escape the special chars (' " \)