Critical attack

I had created a site.
 
But last day I found that my site is not loading well.
 
Some layout issues were found.
 
I checked the database table and found all text/ntext/varchar fields are having some text like
 
<script>http://somesite.com <script>
 
i think this is  cross site scripting. but i got mail from server admin that is a SQLinjection attack
 
What it really can be?
 
i can recover form  errors by restoring database
 
But how can i prevent this happening again?
 
 
...