site hacked - all javascript gone

[eluser]vincej[/eluser]
Thanks ! I was wrong - they did not get all the js. I am using CI 2.1.4. and built a custom business app. I have upgrade to 2.2. I think thy got in either with SQL injection, so your links to testing tools is helpful. It's hosted at InMotionHosting on a VPS. When they got in there used the control panel to delete all the pages. I have learned from Google that CI's xss_clean tool is useless from a protection point of view. Correct ??