On: Site Got Hacked. Want to know how. Ideas?

[noodle]

it is probably not the culprit, but did you take a look at the code in apage.php that processes id just in case? it could be something.

[gaoshan → noodle]

I have looked at the code and the GET request is sanitized before being passed on.

[noodle → gaoshan]

i ask again, then, are you using something like filezilla, and/or do you log in as root without a sudo?

[gaoshan → noodle]

No I am not using Filezilla and root cannot be logged into without sudo.