The first thing to do is remove the code but you should also look to see there is anything else that has been touched. Reinstalling completely may be unnecessary but it won't do any harm.
If you store any personal information of users you should also determine whether or not this has been taken and your client needs to decide whether or not to inform them of the breach.
But it is pointless fixing anything unless you find out how the code was injected. In all my time working with EE I have only seen a few hacked sites. But they all tend to be on shared servers and the attack vector was another popular CMS hosted on the same server.
The injected code might give you a clue as to where the attack came from. Do some Google research on that as it might help determine your next steps.
As far as your client goes, be up front. This kind of thing happens and anyone that thinks any site is 100% secure is fooling themselves. The real issue is how you deal with it now. Be open and thorough. Try to find out how it happened and take steps to prevent it happening again.