Script Injection Attacks

I am working on a site,uploaded it on web but from last few days some SCRIPT inserted some where  into my .aspx pages and in html pages before <body> tag.
i did some thing....
place some thing like this into web.config file;;

<system.web>     <!--This prevents malicious users from using canonicalization and      multi-byte escape sequences to trick your input validation routines.-->

• atou rename database when detach /attach
• Attach Database with Rename(Attash as)
• Are Microsoft® SQL Server® 2014 Feature Pack components compatible with SQL Server 2012
• [DTM_10004] The DTM process terminated unexpectedly.
• create database permission denied in database master
• Microsoft Sql Server 2014 Express and AdventureWorks 2014 Script
• SQL Server Express - Installation Sequence
• Dumb question - SQL Server Express 2014 - where is my "SQL" interface?
• Cannot Generate SSPI Context
• SQL Express usage
• Cannot Export from Sql Server Express 2014 to Access 2016
• Managing SQL 2014 Standard
• SQL 2014 Express and WSUS on Windows 2012 R2
• sql server Migration error
• Install SQL Server 2014 Express in Windows 10
• Suddenly lost ability for client connections to SQL Server Express
• MS SQL Server 2014 fails creating a backup
• Linked server taking time
• Connection pool exceeded error
• Not able to install/Uninstall SQL Server Express 2014