I am suffering SQL Injection type attacks

Avoid using mysqli_* and mysql_ * functions, use PDO, process data entries.

Do a select in your bank and check the privileges of the users, if there are any "strange" users, if root has external access without password, etc.

select user,password,host,grant_priv from mysql.user; 

By running the query above, verify that any user (with the host = %, which would be remote access) is without a password. It is not guaranteed that it has access to the database in the way I cited but it can occur. Check logs MySQL and PHP.

As quoted by @Maniero, the most recommended is to hire someone who understands on the subject, rarity but it is possible.

Solution that can help your problem:

1. Change all user passwords, and especially the database access password, preferably a complex password, type: #@_12!aVxzHors12_8^.

2. Put a new alias in the tables, example, if the table is : usuarios => t_db_usuarios ...

3. If possible, change the database name, use "placeholders" with Prepared Statements in the insert methods / update:

Mysqli_ *

$intVal = $_POST['id'];

$column1 = "exemplo 1";
$column2 = "exemplo 2";
$column3 = intval($intVal);


    $query = "INSERT INTO tabela_nome (column1_string, column2_string, column3_integer)
    VALUES (?, ?, ?)";
    $stmt = $mysqli->prepare($query);
    $stmt->bind_param("ssi", $column1, $column2, $column3);
    if ($stmt->execute()) {
       echo "Sucesso!";
    }
    $stmt->close();

PDO:

try {

    //dados da conexao

    $intVal = $_POST['id'];
    $data = [
             ':column1_string' => 'exemplo1', 
             ':column2_string' => 'exemplo2',
             ':column3_integer' => intval($intVal),
    ];

    $sql = "INSERT INTO tabela_nome (column1_string, column2_string, column3_integer)
    VALUES (:column1_string, :column2_string, :column3_int)";
    $sth = $conn->prepare($sql);
    $exec = $sth->execute($data);
    if ($exec) {
      echo "Sucesso!";
    }
   /*
    Se preferir não enviar como um array, também pode trabalhar cada dado inserido:

     $sth->bindParam(':column1_string', $data[':column1_string'], PDO::PARAM_STR, 255);
     $sth->bindParam(':column2_string', $data[':column2_string'], PDO::PARAM_STR, 255);
     $sth->bindParam(':column3_int', $data[':column3_int'], PDO::PARAM_INT);
    if ($sth->execute()) {
        echo "Sucesso";
    }
   */
} catch(PDOException $e) {
    echo $e->getMessage();
}

1. Never pass insert and update parameters via GET. Take preference use a csrf token for forms by Method POST , thus you will validate that the source of publication, corresponds to the same place of submission.

   For RestFul APIs, use a token with authorization of Type Bearer Token , projects CORS origin for your domain from site, protect yourself from attacks by XSS :

   header('Access-Control-Allow-Origin: http://www.seudominio.com.br');
   header("Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept");
   header('Access-Control-Allow-Methods: GET, POST, PUT');
   

2. Use some website vulnerability scanning tool, here are some examples:

   Https://www.scanmyserver.com/
   https://www.ssllabs.com/ssltest/analyze.html
   https://detectify.com/
   https://www.newnettechnologies.com/vulnerability-tracker.html