Database keeps having issues

I’m having serious issues with a WP database. The content previously existed in Expression Engine and was migrated to WordPress. Everything was fine until one day, someone hacked it to ground zero, deleting all the posts and pages.

I restored it and it was hacked again like this two more times. I decided to stop using the database and exported the content from Tools > Export. Then I created a new database, imported that file, completely deleted all the WP files and started over again.

Everything was fine for about 2 months until yesterday, the site seemed to lose about the last 100 posts and all pages. I’m not sure why. There wasn’t any sign of an attack this time — just missing pages. And unlike the previous issues, only some of the posts were gone, not all.

I’m at a loss for understanding the database issue here. I pretty much did everything to clean up after a hack (started with a new database, started with totally new WP files, repaired/optimized the database tables, etc. Found no signs of additional users or anything). Now the site is completely restored.

But I fear the issue will happen again. One day, poof, half the database will disappear.

Could the problem be due to the structure of the content from the conversion from Expression Engine to WordPress? I manage about a dozen wordpress sites and none of them have ever had this issue.

I’ve tried looking for malicious code in the theme, plugins, and have used the Security Scanner, Theme Authenticity Checker, WordPress Firewall, and other security tools I could find. Nothing.

The only thing strange is that some of the posts have this code:

<p>By <script type=”text/javascript”>
//<![CDATA[
var l=new Array();
l[0]=’>’;l[1]=’a’;l[2]=’/’;l[3]='<‘;l[4]=’ 115′;l[5]=’ 100′;l[6]=’ 111′;l[7]=’ 111′;l[8]=’ 87′;l[9]=’ 32′;l[10]=’ 97′;l[11]=’ 115′;l[12]=’ 105′;l[13]=’ 76′;l[14]=’>’;l[15]=’\”‘;l[16]=’ 109′;l[17]=’ 111′;l[18]=’ 99′;l[19]=’ 46′;l[20]=’ 108′;l[21]=’ 105′;l[22]=’ 97′;l[23]=’ 109′;l[24]=’ 116′;l[25]=’ 111′;l[26]=’ 104′;l[27]=’ 64′;l[28]=’ 115′;l[29]=’ 100′;l[30]=’ 111′;l[31]=’ 111′;l[32]=’ 119′;l[33]=’ 110′;l[34]=’ 97′;l[35]=’ 108′;l[36]=’ 97′;l[37]=’ 101′;l[38]=’ 100′;l[39]=’ 108′;l[40]=’:’;l[41]=’o’;l[42]=’t’;l[43]=’l’;l[44]=’i’;l[45]=’a’;l[46]=’m’;l[47]=’\”‘;l[48]=’=’;l[49]=’f’;l[50]=’e’;l[51]=’r’;l[52]=’h’;l[53]=’a ‘;l[54]='<‘;
for (var i = l.length-1; i >= 0; i=i-1){
if (l[i].substring(0, 1) == ‘ ‘) document.write(“&#”+unescape(l[i].substring(1))+”;”);
else document.write(unescape(l[i]));
}
//]]>
</script>

Does this mean anything to anyone?