There are many ways a site can be hacked. This could range from a silly error in one of your PHP scripts, to some other software on the server being vulnerable.<p>Often sites are hacked by automated bots rather than an actual person. Which means you are using some popular piece of code with a vulnerability. Whatever you run, you need to keep track of security announcements for that product. Especially if it is popular, like Drupal for example. I'm not saying Drupal is bad, it's just that lots of people look for vulnerabilities in it.<p>Look at your server logs (assuming they are still there). This should give you a clue as to how they got access. Also, you say permissions are 755. And the owner is...?