使用sed从php文件中删除行

Question

Website got hacked and it puts code at top line of every php page before the opening <?php tag, i want to use sed to remove it from all files with one command.

It starts with

<?php if(!isset($GLOBALS["\x61\156\x75\156\x61"]))

and ends with

-1; ?><?php

I think this is caused by old version of mailpoet (wysija) wordpress plugin. http://blog.sucuri.net/2014/10/wordpress-websites-continue-to-get-hacked-via-mailpoet-plugin-vulnerability.html

I tried the answers of these two, but solutions isnt removing these lines for me. I would appreciate any and all help as im no expert with unix commands.

Mass removal of malicious line from php files

Removing a string in a PHP file with Start and End

///EDIT

Sample input i used, supposed to remove the line from file, but file stays same, doesnt print anything to terminal

sed -i '1 s/^<\?php if(!isset($GLOBALS\[.*-1; \?>//' *.php

Once i have this command working i want to combine it with find command to run on whole server

Answer 1

You could try this GNU sed command,

sed -r '1s/^<\?php if\(!isset\(\$GLOBALS\[.*-1; \?>//' *.php

Add inline edit option i to save the changes made.

sed -ri '1s/^<\?php if\(!isset\(\$GLOBALS\[.*-1; \?>//' *.php

Answer 2

find . -name "*.php" -print0 | xargs -0 sed -ri '1s/^<\?php if\(!isset\(\$GLOBALS\[.*-1; \?>//' *.php