Urgent HELP Needed ! - my SITE crashed ! :(

[Guest]

hello dudez !
m using a modified lava forum script.. 2/3 hours ago a H**ker Tried to Hack my Site.
He changed my all users avatar link to a .php link! [ i dont know how he did that ]

Now, Plz tell me How Can I solve this error and Secure my script ????
Plz reply.. bcoz, my site is now in offline for this problem :'(

[wapmetal]

sql injection mate, sqli from browser

[nimeshka]

Yep sqli......

[Guest]

Now, what should i do to Secure my script ??? @ wapmetal , nimeshka

[something else]

use mysql_real_escape_string () on EVERY input a user can make

[Guest]

@ Something Else :
Like this ????
$page = mysql_real_escape_string($_GET["page"]);

[something else]

yes and any other variable that a user can change (see post 2)