Linux sed command replace string not working

Question

My wordpress site has been infected with the eval(gzinflate(base64_decode(' hack.

I would like to ssh into the server and find replace all of these lines within my php files with nothing.

I tried the following command:

find . -name "*.php" -print | xargs sed -i 'MY STRING HERE'

I think this is not working because the string has / characters within it which I think need to be escaped.

Can someone please let me know how to escape these characters?

Thanks in advance.

Answer 1

I haven't tried so BACKUP YOUR FILES FIRST! As mentioned in some of the comments, this is not the best idea, it might be better to try some other approaches. Anyhow, what about this?

find . -name "*.php" -type f -exec sed -i '/eval(gzinflate(base64_decode(/d' {} \;

Answer 2

if you have perl available :

 perl -p -i'.bck' -e 's/oldstring/newstring/g' `find ./ -name *.php`

=> all files modified will have a backup (suffix '.bck')

Answer 3

Bash offers different delimiters such as @ % | ; : / in sed substitute command .

Hence, when the substitution involves one of the delimiters mentioned, any of the other delimiters can be used in the sed command so that there is no need to escape the delimiter involved.

Example:

When the replacement/substitution involves "/", the following can be used:

sed 's@/will/this/work@/this/is/working@g' file.txt

Coming to your question, your replacement/substitution involves "/", hence you can use any of the other delimiters.

find . -name "*.php" -print | xargs sed -i 's@/STRING/TO/BE/REPLACED@/REPLACEMENT/STRING@g'