Hmm! That means my tiket system is Vulnerable to injecting or hacking
No, I disagree, for injection vulnerabilities it would mean that osTicket was not correctly escaping user inputs before using that input. AFAIKS where I have looked through the code whilst looking at bugs it escapes user inputs and so makes it rather hard to inject SQL (though I'm no expert). The last rc5 upgrade I think corrected one of the unescaped values. Quite possible that there is some more ways of tricking unescaped inputs into the SQL but some random ticket system doesn't seem to me to be as rewarding as say a banking site.
Plain old hacking would be if someone brute-forced the logons. How hard that is solely dependant upon your password complexity - the more complex then it just isn't reasonable to hack.
For sniffing the passwords then as Peter suggests - use SSL (https:). Man-in-the-middle attacks aside, someone sniffing SSL traffic will not get your passwords.
Many (nearly all ?) PHP logon scripts involve sending passwords in clear text in a POST method and the recommendation has always been that if you want to secure that POST then you must use HTTPS.
Finally, someone would probably get access to your systems through either,
a) attacking the host e.g. via PLESK or cPanel or they find some other account on a shared host that gets them to something useful like root so they can wander over your site (who here hasn't had a host with r57.txt shoved on it ?).
or
b) Todays favourite which is keylogging your PC and nothing of osTicket/.htaccess/SSL can stop that and that is why exploits involving keyloggers are so popular today.
