If you download a copy of the source code using tortoiseHG, and go to mojoportal\Web\Admin you find the source code for the admin pages.

Is pretty recommended not to fork the code of mojoportal, if you need to make server side validations, I recommend implementing a http handler or JavaScript depending on your needs, if you describe better what you are trying to accomplish may be we can give you a more detailed response

Your question makes no sense.

1. We already have server side validation on the login and registration pages and other places where it is needed.

2. We already use parameterized queries, we never concatenate user input into sql statements, nowhere in mojoPortal are we vulnerable to sql injection.

Of course in your own custom features you must implement your own validation and secure development practices.