Recently my drupal site is hacked. When i see website log from drupal admin panel someone trying to inject code from url. I searched my website(drupal) directory lots of code in page appended and new files are created. 

**My question is that**

1. Is this possible to inject code from url
2. If use how to protect them in drupal

**log image**
[![enter image description here](https://i.stack.imgur.com/4DRWw.png)](https://i.stack.imgur.com/4DRWw.png)
[![enter image description here](https://i.stack.imgur.com/rFSX1.png)](https://i.stack.imgur.com/rFSX1.png)