Originally Posted by sortie

That code is making all your html pages execute as php. (I believe )

So, you either needed that and did it yourself for the most dumb reason or
you don't really have many php pages so the hacker has to put his php inside
you html pages for them to execute or the hacker just wanted to infect all files.

If you didn't "secure" the ccbill member script then you could
get a hacker doing sign ups.