How to call php script using html form elements instead of command line?

I admin several websites which have just been subject to the hack outlined here: http://frazierit.com/blog/?p=103

I need to clean the code that has been injected into all the php files.

User Crystaldawn has made a clean up script available here http://crystaldawn.net/fix_hack but it needs to be run via command line which I am unfamiliar with.

QUESTION: Is it possible to execute this script (below) using an html form submit button or similar? And if so, how?

Thanks in advance, really appreciate any help, I need to clean up 8 sites and this could save me (and others) many many hours.

<?php
//Create back files?
define('CREATE_BACKUPS', FALSE);

if (!is_dir($argv[1]))
{
   echo "You must enter a valid path such as /home/infected_dir or infected_dir for this script to function.\n";
   exit;
}

//Search the path for all php files, opening each one, and checking to see if it's infected

//First, get an array list of all valid .php files.


$files = listdir($argv[1]);
foreach ($files as $filename)
{
   //We only need to check php files, so we add that here
   if (file_extension($filename) == 'php')
   {
      //This is a php file so lets check it to see if it's infected.
      $contents = file_get_contents($filename);
      $backup = $contents;

      //There will always be 2 opening tags in an infected file and since the hack is always at the top, it's easiest to test for this right away.
      $test = between('<?php', '<?php', $contents);

      //This particular hack likes to use toolbarqueries so we test to see if our chunk is an infected chunk.  If your website uses this url somehow, then add extra if statements as necessary.
      if (after('toolbarqueries', $test))
      {
         //This chunk is infected.  So lets replace it and resave the file.
         $contents = str_replace('<?php'.$test.'<?php', '<?php', $contents);

         //Now save it! Woohoo!
         file_put_contents($filename, $contents);
         if (CREATE_BACKUPS)
         {
            file_put_contents($filename.'.orig', $backup);
         }

         echo "$filename has been cleaned.\n";
      }
   }
}

function after ($this, $inthat)
    {
        if (!is_bool(strpos($inthat, $this)))
        return substr($inthat, strpos($inthat,$this)+strlen($this));
    };

    function after_last ($this, $inthat)
    {
        if (!is_bool(strrevpos($inthat, $this)))
        return substr($inthat, strrevpos($inthat, $this)+strlen($this));
    };

    function before ($this, $inthat)
    {
        return substr($inthat, 0, strpos($inthat, $this));
    };

    function before_last ($this, $inthat)
    {
        return substr($inthat, 0, strrevpos($inthat, $this));
    };

    function between ($this, $that, $inthat)
    {
     return before($that, after($this, $inthat));
    };

    function between_last ($this, $that, $inthat)
    {
     return after_last($this, before_last($that, $inthat));
    };

    // USES
    function strrevpos($instr, $needle)
    {
        $rev_pos = strpos (strrev($instr), strrev($needle));
        if ($rev_pos===false) return false;
        else return strlen($instr) - $rev_pos - strlen($needle);
    };

    function listdir($dir='.') {
    if (!is_dir($dir)) {
        return false;
    }

    $files = array();
    listdiraux($dir, $files);

    return $files;
}

function listdiraux($dir, &$files) {
    $handle = opendir($dir);
    while (($file = readdir($handle)) !== false) {
        if ($file == '.' || $file == '..') {
            continue;
        }
        $filepath = $dir == '.' ? $file : $dir . '/' . $file;
        if (is_link($filepath))
            continue;
        if (is_file($filepath开发者_StackOverflow社区))
            $files[] = $filepath;
        else if (is_dir($filepath))
            listdiraux($filepath, $files);
    }
    closedir($handle);
}

function file_extension($filename)
{
   $info = pathinfo($filename);
   return $info['extension'];
}
?>

It's just a script. stuff it into your document root somewhere as "cleanupscript.php", and then point your browser at it:

http://yoursite.com/cleanupscript.php

no need for forms or command line access.

Just put $argv[1] = '/path/to/your/site/document/root'; at the start of the script, so it's not dependent on command line arguments.

You can find form data in $_POST. So, if you make a form and set its action to your script, you can find all of the fields in $_POST.

From there, you should be able to modify your script.

In it's current form, this script cannot be run effectively via a web server. There are two reasons:

1. The scripts uses $argv, which is a reference to command line arguments. If you run the script via a web server (as an HTML page) that variable will not be populated.

2. The script modifies files. Your web server user may or may not have permission to edit those files.

To execute this script from the command line, open a shell and execute

php <script_name> <path_to_direcotry>

where <script_name> is the name of Crystaldawn's script, and <path_to_directory> is the directory you wish to clean.

If you cannot run this via the command line, you will need to change the references to $argv to something like:

$_GET['directory'];

and call the script like this:

http://yourwebsite/script_name.php?directory=/home/www/

If you use this method, you will want to add validation and escaping to make sure someone can't enter an invalid or dangerous value for directory.

Second, you will need to check your file permissions to ensure that the webserver user can edit the files in the directory you specify.