I think my website got hacked

I think, these are your session-keeping files, but for some reason they are put in a wrong place.

What do you mean the session-keeping files ?
For this page which is only add the emails in the DB I didn't use session I just use the session for showing the errors of success action which is in using set_flashdata() and as I read this session will delete after redirect a page!

But if it's the case how can I solve it? Can you please advice me