Calimar,
 
   Testing web applications is not something that you just jump into and get done.  There are many factors to it.  My suggestion to you is that you first consider how you have deployed your application.  You should look at resources like OWASP http://www.owasp.org/index.php/Main_Page which has guides to secure deployment and considerations for writing scripts that permit user interaction.  You will also find some useful guides to assessing your applications and tools to assist with the assessment.

   Don't forget to check out the XOOPS forums http://www.xoops.org/modules/newbb/.  I am willing to bet that somebody here has had the same experiences you have and they will be able to assist you.  If nobody has experienced your problems then the experts monitoring these forums are going to want to know about your issues so that they can begin to address them within their environments.

Go forth and do good things,
Cutaway