Thanks for locating this.

I had looked at the live index and a copy I had locally and at first glance they looked the same. Both had a lot of blank lines at the bottom and I didn't notice the one on the server had that script element at the very end.

I'll have to see about moving the site to my shared hosting site eventually. This is the only site that the owner has hosted elsewhere, but I think telling him that it's been compromised is going to get him to change his mind quickly.