I think my website got hacked

You need to set your session_save_path to the folder where your session data will be stored. Yours is NULL.
http://www.codeigniter.com/user_guide/li...references

what if i set sess_save_path = '/sessions'. does it matter where i wanna save?
or
what if i change the sess_driver to 'database' ? then the problem will solve? because i think the path is only when we are using file, am i right?