Update,
rmeeuwsen gave me access to his backend so I could see what was going on.
First and foremost I recommend changing all passwords.
Second, do what I mentioned in the PM to you.
Third, Keep all scripts up to date.
The hacker did in fact get into his sql database and left a redirect. It was easy to spot and fix. I looked over other parts of the database where I thought they could have hid code and saw nothing.
I also had a glance over the files on the server and didn’t see any malicious code. That doesn’t mean there’s none there but chances are there isn’t. This hack sees like a simple sql injection to deface the site.