How to solve the SQL injection problem

A good way to avoid SQL injection problems is to use a tier-based architecture for your web site. For example secure all of your database transactions in explicitly managed functions and never allow SQL queries to be made in high level code. Place your query functions in a persistence or data tier that lies under a business object tier. Then use the business object tier to call the query functions using only the parameters that you need. You would probably do good to pick up a book on multi-tier web development in C# or even a generic one (non C# and non language-specific). You could also only allow your query functions to call stored procedures, making it less possibly for SQL to be injected, because SQL stored procedures only accept certain types of arguments.

Just some ideas.

Edit: I just read your post more thoroughly and noticed that you didn't use C# at all, rather you're using JavaScript. You would still do good to get that book (make sure it is not language-specific, so that it just goes over the theories and basics) and you could still write a multi-tier system using JavaScript I think. You'll just have to be more creative, but you may still need to include some back end coding, like PHP or ASP to get the right kind of SQL protection.