Php find files containing string

Question

I changed my password and username for mySQL and I need to replace the connection string in all of my PHP scripts accordingly.

I am having trouble with the command because many of my php file names contain spaces.

What can I change to make this command work without having "No such file or directory" errors?

Here is the command I am using:

pattern='mysql_connect("localhost", "olduser", "oldpwd")'
replacement='mysql_connect("localhost", "newuser", "newpwd")'
find . -name "*.php" | xargs -n 1 sed -i -e 's|$pattern|$replacement|g'

I am unfamiliar with xargs and sed and I copied this code from this answer to a similar question.

(I think I will put the mysql_connect statement into a php include file and only change it in one place next time.)

I'm running Ubuntu 14.04 LTS using BASH

I'd like to search for suspicious php-files on a linux machine. Currently I have a solution for large strings, but few days ago I found a new version of a suspicious script. Instead of just setting a variable in one long line, the new version splits the line into chunks and concat it.

Here is a sample:

    $dlujpdi = 
    'KXskXXxbZSgnb2R5cmltcHViTkVDIHBvbWVvLCR0clRoPmRvc2V7TWVzJGZpb25zRV9'.
    'MICRsbWUoaXMtbmV3Y2Uoan07cGVucy0+dD0kY291KCdtZWxkcnJwaGlzJy4nZighLC'.
    'RwdGVkLT5TZXcgaWYobVsxdGhpKCRwZGRybiBmJHBhbiAkdGhpJHRobmQpQ2hhJGFkZ'.
    'XQsdGVkZCgnKXtyZXI9fXxcdXJudGlvbmU7b2RlaGVsaXZlOV17ZWRDLicodHIob24g'.
    'YnJldHRhb21IY3RpdGlvcy0+cy0+TVRQKCRkW109KTt9JHN0ZHkudGhpaGFybWF0J0N'.
    'vJyAnYWluJGJvc19rXC9cJG1zYm9kdGh0PnZhbiI7UyopJHN0bGVyJyc7cycpYSl7Py'.
    '8iaXMtbWUpLT5zKHN0KD8hOkRFcy0+cmV0QWx0c3MiYW1laWYoKS0kaGlzSCcsJGJvK'.
    'DIsNzdcc3RyLjIzJycsX2Nvcy0+ZXNwPmFkc2FnezY1OjpEPnRlb2R5bWF4aW1lcHVi'.

and so on. That why I'd like to search for this pattern, where Base64 Parts are concat together with a dot like here. Is there a way to do it with Linux Tools without writing a new short program?

asked Jan 19, 2018 at 20:21

6

On a Linux system, you could use something like:

grep -Erl '[[:alnum:]/+]{20,}' /path/to/php/parent/directory/*

Which tells grep to recursively look for files that contain at least 20 sequential characters from the Base64 alphabet; matching files have their filename printed. Adjust the 20 to taste.

answered Jan 19, 2018 at 20:39

Jeff Schaller♦Jeff Schaller

64.3k33 gold badges104 silver badges235 bronze badges

2

See more:

The filename is files_in_dir.php
In the working directory there is a folder. That name is files_test .
In that folder there are two text file:

file1.txt contains:

AAAAAAAA
BBBBBBBB
CCCCCCCC
DDDDDDDD

file2.txt contains:

AAAAAAAA
BBBBBBBB
DDDDDDDD
CCCCCCCC

We are searching for "CCCCCCCC" pattern and want to know its line number and echo $line_number of each file. That's all!

What I have tried:

<?php


$files = array_diff(scandir("files_test"), array('..', '.'));


echo getcwd()."\n";

echo "THINGS IN WORKING DIRECTORY";

foreach (scandir('.') as $file)
    echo $file . "\n";
    
echo "\n";


foreach($files as $file) {
  echo $file."\n";
  $search      = "CCCCCCCC";

  $lines       = file($file);
  $line_number = false;
  
  while (list($key, $line) = each($lines) and !$line_number) {
   $line_number = (strpos($line, $search) !== FALSE) ? $key + 1 : $line_number;
  }

  echo "The line number is: ".$line_number."\n";

}
?>