Recently my drupal site is hacked. When i see website log from drupal admin panel someone trying to inject code from url. I searched my website(drupal) directory lots of code in page appended and new files are created.
My question is that
log image
The logged requests are clearly attacking the security vulnerability SA-CORE-2018-002. But this is not your main concern now when you've already been hacked, because most hackers close the vulnerability after they take over your site to not get hacked again by other hackers. You probably need to restore your site from a backup before SA-CORE-2018-002 (but then of course go online only after applying the security updates) or if you have no backup available setup the site from scratch, because it's nearly impossible to clean a hacked site from all malicious code and data.
See Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002 and the FAQ.
Yes, it's possible to inject code from URL it that is not properly Sanitized. Check this link for how to prevent database injection attacks and write secure code.
Always give proper permissions to files for anonymous users.
Upgrade to latest version of Drupal for new security releases (Test it before moving to production)
Look at all the roles on your site. What permissions do they have? Which have advanced permissions that could be used to take over a site? Perhaps there is a new role you know you didn't make. Is there one user with that role? Check fo this.
Plan for the Worst
While no one wants to consider that their site could be vulnerable, you must hope for the best but plan for the worst. This means making frequent backups that you can upload in the event that someone hacks into your Drupal site. Backup and Migrate is one such module that allows you to schedule backups and import saved databases.
See this link for more info on "Remote Code Execution"
