I agree to the comment above, once the server has been compromised, you should start by considering all data, files, and processes in the server as tainted. And as mentioned above, restart over.
If you can identify exactly what has been compromised (from what hasn't), then you could probably take a partial restore. But if this is not the case, stick to the recommendation above.
In terms of data (text), hopefully you have a backup that hasn't been tampered from the attack. But be very wary of trusting data (text) as I have seen webpages that include bot commands, disguised as html tags.
To analyze a website, think first about the different components it uses. As you listed: PHP, CPanel, database (as you mentioned SQL injection). Then add the other components, such as web server (are you running Apache web, Tomcat or something else?), the authentication process you are using (is it HTTP digest authentication, or may be using LDAP). What is the password policy for your website? Once you have a list of the different components, check their configuration and/or patching status (everything updated?).
To take a more complete approach to review the security of your website, I also agree to previous comment on using the OWASP website. They have very good docs and tools to help you. I would start with the OWASP Top 10 Web Application Security Risks to give you an overall idea of the problems commonly found in web sites. Then would use the OWASP Testing Guide mentioned above, which is more detailed and lists tools and examples of attacks.
Also consider using OpenVAS Vulnerability Scanner (openvas.org) and NMAP Security Scanner (nmap.org). These tools are very powerful and easy to set up. NMAP will give you a list of open ports in your web server (so you can ask if those ports should be open and which processes are running on the ports), while OpenVAS tests for vulnerabilities on those ports (you can also run OpenVAS locally to look for non-port related issues).
Finally, look first for the 'low-hanging fruit' problems. Start asking if there is a weak password or a mis-configured service that may be the attacker used to deface your server. Attackers usually look for this things first... and unfortunately works a lot of times.