You need to check your web server log to know how the hacker got in.