需要删除前N行的grep结果文件

Question

I'm trying to get rid of a hacker issue on some of my wordpress installs.

This guy puts 9 lines of code in the head of multiple files on my server... I'm trying to use grep and sed to solve this.

Im trying:

grep -r -l  "//360cdn.win/c.css" | xargs -0 sed -e '1,9d' < {}

But nothing is happening, if I remove -0 from xargs , the result of the files found are clean, but they are not overwriting the origin file with the sed` result, can anyone help me with that?

Many thanks!

Answer 1

You should use --null option in grep command to output a NUL byte or \\0 after each filename in the grep output. Also use -i.bak in sed for inline editing of each file:

grep -lR --null '//360cdn.win/c\.css' . | xargs -0 sed -i.bak '1,9d'

Answer 2

What's wrong with iterating over the files directly¹?

And you might want to add the -i flat to sed so that files are edited i n-place

grep -r -l  "//360cdn.win/c.css" | while read f
do
   sed -e '1,9d' -i "${f}"
done

¹ well, you might get problems if your files contain newlines and the like. but then...if your website contains files with newlines, you probably have other problems anyhow...