How to Implement Security Measures to Prevent SQL Injection and XSS in My Web Application?

Good day! Great question, one seriously worth investigating and determining the root cause.

You mention a security audit, what was the security audit? And what specific controls were the auditors (or automated scan) looking for?

SQL injection and XSS are server side vulnerabilities existing in web application code, due to lack of user input validation, user input sanitization, or generally accepting the use of scripting / SQL characters (high level). The efforts and remediation will largely be determined by what the scan was reviewing.

Was it doing a code review? Looking for a Web Application Firewall? Was it injecting scripting or SQL code into the web input areas successfully?

I think a bit more detail around that will help return a focused response and really help mitigate that (those?) issue. Thanks!