Java EE (Java Enterprise Edition) General Discussion

hi i have a big problem with my JSF web site
i have deployed my website on a very famous Server and suddunly hackers start to hack it
this is what i have noticed

1/for example suppose i have two pages login.jsp and welcome.jsp
when they were deployed when a user enter my website by typing http://localhost:8080/mywebsite
he will be redirected to page http://localhost:8080/mywebsite/login.faces
and he must identify him self next if he was recongized he will be redirected to http://localhost:8080/mywebsite/welcome.faces

but




....
i have a freind of mine who write in the explorer http://localhost:8080/mywebsite/welcome.faces
how can i prevent that?(i want that he must log in then go to that page)


2/are JSF prevent SQL injection?

3/ are JSF prevent SQL XSS?
thank you