Question

My site is getting hacked. It add some script on my file at the first line of all my php file. I want to get remove that script using Netbeans search and replace with REGEX options.

It seems the hack script has same pattern on it

<?php /**/ eval(base64_decode("[SomeRandomString]"])); ?>

Can you please give me REGEX pattern to remove the string above?

Here is the example of my hacked full script http://ideone.com/6ltMf

Answer 1

Something like this matches your short example and the one you pasted:

$pattern = '~^\<\?php\s?\/\*\*\/\seval\(base64\_decode\(\".*?\)\)\;\s?\?\>~'
// You might need to incorporate the multi-line option at the end of the pattern

Hindsight is 20/20: In the future you should consider using a versioning system to quickly reset all the altered files.