Hard to say too much not knowing what infrastructure its on, but would start with the basics of good input sanitization to avoid sql injection.