Connecting to remote MSSQL server via PHP

I have a web server running a popular PHP shopping cart. Part of the business requirement dictates that I need to save some sensitive customer information to a remote MSSQL database as saving that information on the web server violates PCI-DSS requirements.

When I make my calls to the remote machine and perform some CRUD, what vulnerabilities do I need to consider when sending SQL statements through the tubes?