Protect drupal code injection from url Recently my drupal site is hacked. When i see website log from drupal admin panel someone trying to inject code from url. I searched my website(drupal) directory lots of code in page appended and new files are created. 

My question is that


Is this possible to inject code from url
If use how to protect them in drupal


log image
The logged requests are clearly attacking the security vulnerability SA-CORE-2018-002. But this is not your main concern now when you've already been hacked, because most hackers close the vulnerability after they take over your site to not get hacked again by other hackers. You probably need to restore your site from a backup before SA-CORE-2018-002 (but then of course go online only after applying the security updates) or if you have no backup available setup the site from scratch, because it's nearly impossible to clean a hacked site from all malicious code and data.

See Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002 and the FAQ.