Website โดนแฮ็ก ทุกอาทิตย์ ใครพอมีวิธีปรับแก้ Source code บ้าง

<?php
// Connect
$link = mysql_connect('mysql_host', 'mysql_user', 'mysql_password')
    OR die(mysql_error());

// Query
$query = sprintf("SELECT * FROM users WHERE user='%s' AND password='%s'",
            mysql_real_escape_string($user),
            mysql_real_escape_string($password));
?>

<?php
  session_start(); 
  
  include "connect.php";
   $strSQL = sprintf(
    "SELECT * FROM `member` WHERE `Username` = '%' AND `Password` = '%s'",
    mysql_real_escape_string($_POST['username']),
    mysql_real_escape_string($_POST['password']));
  $objQuery = mysql_query($strSQL); 
  $objResult = mysql_fetch_array($objQuery); 
 
   if(!$objResult) 
     { 
	    echo "<script type='text/javascript'>";
		echo "alert('user and password wrong input try me again!'); location.href='loginadmin.php';";
		echo "</script>"; 
        
      } 
    else
 { 
        
$_SESSION["UserID"] = $objResult["UserID"]; 
$_SESSION["Status"] = $objResult["Status"]; 
$_SESSION["Name"] = $objResult["Name"];
         
  session_write_close(); 
  if($objResult["Status"] == "admin") 
     { 
	    echo "<script type='text/javascript'>";
		echo "alert(' Welcome to System Tool Menager '); location.href='main.php';";
		echo "</script>";
       
     } 
      else
     { 
		 echo "<script type='text/javascript'>";
		 echo "alert('user and password wrong input try me again! '); location.href='loginadmin.php';";
		 echo "</script>";
       
      } 
  } 
  
mysql_close(); 
?>

<?php
  session_start(); 
  include "connect.php";
  
  #------------------Function Clean Input เพื่อตัดค่าแปลกปลอม--------------------#
  function clean_input($input){
		$input = trim($input);
		if(get_magic_quotes_gpc()) {
			$input = stripslashes($input);
		}
		#ตัด html tag
		$input = strip_tags($input);
		return mysql_real_escape_string($input);
	}
  #-------------End Function---------------#
  
  
  if($_SERVER['HTTP_REFERER'] <> 'http://msp.agro.ku.ac.th/loginadmin.php'){ #เช็ค Refer ว่ามีการส่งฟอร์มมาจากหน้า Login ที่เราสร้างจริงไม๊
	  	echo "<script type='text/javascript'>";
		echo "alert('user and password wrong input try me again!'); location.href='loginadmin.php';";
		echo "</script>"; 
  } else {
  
   $strSQL = sprintf(
    							"SELECT * FROM member WHERE Username = '%s' AND Password = '%s' ",
								clean_input($_POST['username']),
								clean_input($_POST['password'])
							);
  $objQuery = mysql_query($strSQL); 
  if(mysql_num_rows($objQuery) <= 0){ #ถ้าเช็คแล้วไม่มี User และ pass ที่ตรงกัน ก็ให้ล็อคอินใหม่
	  	echo "<script type='text/javascript'>";
		echo "alert('user and password wrong input try me again!'); location.href='loginadmin.php';";
		echo "</script>"; 
  } else {
	  $objResult = mysql_fetch_array($objQuery); 
 
	   if(!$objResult) 
		 { 
			echo "<script type='text/javascript'>";
			echo "alert('user and password wrong input try me again!'); location.href='loginadmin.php';";
			echo "</script>"; 
			
		  } else  { 
			$_SESSION['UserID'] = $objResult['UserID']; 
			$_SESSION['Status'] = $objResult['Status']; 
			$_SESSION['Name'] = $objResult['Name'];
 			session_write_close(); 
			
			  if($objResult['Status'] == 'admin') 
				 { 
					echo "<script type='text/javascript'>";
					echo "alert(' Welcome to System Tool Menager '); location.href='main.php';";
					echo "</script>";
				   
				 } 
				  else
				 { 
					 echo "<script type='text/javascript'>";
					 echo "alert('user and password wrong input try me again! '); location.href='loginadmin.php';";
					 echo "</script>";
				   
				  } 
 		 } 
  	}
} #จบการเช็ค Refer
mysql_close(); 
?>