Malicious code on my Drupal 7 website
Without knowing the specifics or your installation, nobody can give you the exact reason you got hacked.

I suspect that your server is running a vulnerable version of PHP and that Apache has write access to your site files.  Typically, there will be a bot that will GET a specifc URL that will download a script onto the server, which will then append to well-known (or all) Javascript files.  These additions will add in the malicious code.

After you fix this problem, you should.


Patch your PHP to bring it up to the latest revision for your version of PHP.
Update Drupal to the latest revision for your version.
Clean out your /tmp folders on the server and reboot it.
Read up on Securing file permissions and ownership.  It is important that you fix permissions each time you update files; a lot of FTP clients botch permissions when they upload.
If you are on shared hosting, consider moving to a VPS or Drupal specific hosting.  Running Apache as your login account makes sense for the server owners, not the website owner.
Create a git repo in your DOCROOT, add all of the files (the standard gitignore shoud be fine), and create a "remote" repo on the local filesystem that you can git push to.  This makes backuping up and restoring site files pretty easy.