How to avoid second order sql injection attack when using database data with fgetc( stdin) in c++

Question

std::string sQuery;
char ch= NULL;
ch = fgetc(stdin);
if(ch != EOF)
{
    sQuery += ch;
}

checkmarx is complaining about the code saying that fgetc