Well if people using old URL you cannot do anything for that. Simply shut down the old site or write logic to redirect to new site if accessed.
Now to protect from hackers you need to make sure your SQL Queries use Parameters to pass data and avoid Dynamic SQL so that you can prevent SQL Injection