It seems there are alot of security holes and your site is large, how about using sessions and insert checks for every page, and use methods=”post” for forms, there are also nice php functions that help in processing page requests before a page is sent, like the mysql_prep() just as an example