website hacked repeatedly

The website I created for our local group of car guys has been hacked twice now in 3 days Some months ago I emailed the password to somebody so that they could upload a big video file ... everything seemed fine until a few days ago when a bunch of the files (mainly pictures) were deleted and there was a new file "love.html" which basically said "Hahaha I hacked your page." ...
Part of the website I programmed which could have a security loophole ... either from putting some PHP code to delete files in a textarea in a form (although I use a parsing function that's supposed to get rid of PHP), and also allowing people to upload files (but only registered members should be able to do this.) So they could've gotten in through one of those loopholes, or just gotten the password from that email, or just cracked the password on their own. I think it's one of the first two because the password was not changed, and they also didn't access the MySQL database, only the files.
Anyways I had the password changed ... damn hosting company sent an email saying "Your new password is this" ... and today it's been hacked again. This time only one file was changed, the index.php to say "I hacked your page" again ... seems to be a different hacker this time. So possibly they have access to my email or even to my actual computer ... I just backed up all files and the MySQL database, changed my email password, changed my website password again (over the phone and asked not to get an email about it) and upped the security on my connection.
Anyways just wanted to rant about that and also ... since my website is for local people only and both hackers were using some sort of middle east language ... I was wondering if anybody knew how to block all IPs outside the US? Thanks for the help This blows

 

Thanks, that's comforting ... I do remember one and I'll search for it. I've been going through some PHP security articles; hopefully I'll be able to fix whatever the problem was.

 

I do check the mime types on all uploads but I don't track who's doing what so I'll start doing that. I think it was probably the contact form though - forgot to striptags on the input.

Strangely there was no .htaccess file ... so I created one and uploaded it. I guess I forgot to make one for this website but I'm surprised there wasn't a default one on the server.

Thanks, I programmed lots of it myself so I can't really patch it, but I think I found the flaw in the code.