I don't have the money to hire a security consultant since I'm only 16
You are 16 doesn't mean you don't have money to hire :D .
You don't need to hire anybody. There are many free online tools which you can use to test the vulnerability of your web application.
Try using http://www.zubrag.com/tools/sql-injection-test.php to test SQL Injection vulnerability
http://www.parosproxy.org : web traffic recorder, web spider, hash calculator, and a scanner for testing common web application attacks such as SQL injection and cross-site scripting
HP WebInspect software [ not free ] tests common web attacks such as parameter injection, cross-site scripting, directory traversal, [ try googling it ]
http://portswigger.net/suite/ : Burp Suite is an integrated platform for attacking web applications. It contains all of the Burp tools with numerous interfaces between them designed to facilitate and speed up the process of attacking an application. All tools share the same robust framework for handling HTTP requests, persistence, authentication, upstream proxies, logging, alerting and extensibility.
