Problems the query takes me as Alert Injection SQL

Thank you in advance for answering.

The problem is that when I run the following query I get an alert injection SQL .

\!/ ALERTA !!!!!

[09 Aug 2016 10:45:30] <br>
TIPO: SQL INJECTION-INTERNO <br>
URL ATAQUE: /gci//workflowgestion/workflowgestion.php <br>
CAMPO: sql <br>
ATAQUE: UPDATE detalleplannorma SET dtleplnanrma_observacion = ('FLUJO ENVIADO - ' + COALESCE(dtleplnanrma_observacion, '') ) <br>
, wrkogsto_id = #wrkogsto_id# WHERE dtleplnanrma_id = 404 <br>
DESCRIPCION: update detalleplannorma set dtleplnanrma_observacion =|||||dtleplnanrma_observacion <br>
IP: ::1 <br>
SERVER-NAME: localhost <br>
-----------------------------------------------------

This is the function that runs when I click to update; I think it's because the SQL is sent through the URL, although I'm not sure. I would really appreciate it.

<script>
                $(function(){ <br>

                    $("#workflow").click(function(){ <br>

gestionar_workflow ('<?=$PATH_GCI?>/workflowgestion/workflowgestion.php', '<?=$wrko_id?>', '<?=$asunto_workflow?>', '<?=$crgo_id?>', '<?=$sql_workflow?>', 'GCI', '<?=$wrkogsto_id?>', 'MODAL', '');
<br>
    $('body').on('dialogclose', '#dialog-window-gci-workflow', function(){
<br>
                            window.open('<?=$window_open_after?>');
                            <br>
                            $('#dialog-window-gci').on('dialogclose',
<br> function(){ 
            <br>                    $('body').find('table[id^="grid_modulo_"]').each(function(){
<br>
                                    $(this).trigger('reloadGrid');
<br>
                                });
<br>
                            });
<br>
                        });
<br>
                    });
<br>
                }); 
<br>
            </script>