[Tfug] website file ownership problem

[Paul Scott]

A website I maintain - http://www.susanartemis.com/ recently it has
become inaccessible because it's main control file has had it's
owner/group changed to "root/wheel" and there is no read permission. 
They are suggesting that I upload a new "script" without security flaws
but how can I upload/replace a file that their admin now owns?

The hosting company - 1hourhosting.com claims that the site has been
hacked because of a security flaw in my code.  It is certainly possible
that my simple code PHP code might have security flaws but could that
have allowed a file's ownership to be changed to root?

TIA for any help or ideas,

Paul Scott