My website is undergoing an SQL injection attack redirecting to ad site dolohen[dot]com.

I need to strip out the javascript before it is served up.

Is there a filter I can add or update to remove everything between tags in wp_posts post_content

I am new to programming wordpress but not to sql and databases.

Its a bit confusing because some people want to put javascript in posts but can't. Yet these SQL injectors seem to do it at will!

Thanks Phil


If the javascript code is actually embedded in the post content, you could use php filters such as the_content to remove script tags. But that will strip it out at runtime, every time the page is loaded. If this is your situation, then you'd be better off stripping it out of the wp_posts.post_content table/column from the database.

If you want to quickly strip out the content just for display, you can use the the_content filter, like so (in your theme's functions file)

add_filter('the_content', function($content){
    return wp_kses_post( $content );

But again, this will run every time the page is loaded. It's more of a short term fix.

| improve this answer | |
  • Thanks Jake, how do I activate the 'the_content' php filter. – PHILBO Oct 3 '19 at 17:46
  • I am on my second iteration of cleaning out my posts manually but the javascript keeps coming back. When I query the database with phpmyadmin post come up with zero content??? Strange. One step at a time. – PHILBO Oct 3 '19 at 17:48
  • You aren't finding any script tags in post_content by searching with phpmyadmin? – JakeParis Oct 3 '19 at 17:54
  • (You may already know this, but ) To clean a hacked site, you have to look everywhere. I've found hacked htaccess, extra code in index files, bogus 'ico' files, and a hacked unused theme. Plus extra files that didn't belong there. To fix: change all credentials (hosting, database, admin/users), look at all folders for files that aren't supposed to be there (and look inside the ones that are there), update everything (PHP, WP, themes, plugins) from known good sources (manually), and more. Here's my cleanup notes: securitydawg.com/recovering-from-a-hacked-wordpress-site – Rick Hellewell Oct 4 '19 at 1:15
  • 1
    This is courtesy reply to Jake. Your answer started me off on a journey. I realised I had not got a clue what you had just told me and did not know what an add_filter was. Just to let you know, after a couple of weeks fairly intense reading on line and purchasing a few good WP/PHP/MySQL/Apache books and PHPDesigner8 I am have nearly understood your answer :-) In the meantime I have added a database trigger, before update which looks for scumbag script insertions and so far it's keeping these parasites at bay. I am developing a plugin to go on the attack against these people. Thanks to Rick too – PHILBO Oct 15 '19 at 10:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.