All PHP files getting hacked

Question

Like always, just want to say thank you for all of the help and input in advance.

I have a particular site that I am the web developer for and am running into a unique problem. It seems that somehow something is getting into every single PHP file on my site and adding some malware code. I have deleted the code from every page multiple times and changed FTP and DB passwords, but to no avail.

The code that is added looks like this - eval(base64_decode(string)) - which the string is 3024 characters.

Not sure if anyone else has ran into this problem or if any one has ideas on how I can secure my php code up.

Thanks again.

Answer 1

The server itself could be compromised. Report the problem to your web host. What is their response?

An insecure PHP script coupled with incorrect file permissions could give the attacker the ability to modify your PHP files. To eliminate this possibility I would take the site down, delete all the files, re-upload, then switch permissions on the entire site to deny any writes to the file system.

Edit: As a short-term fix try asking your web host to disable eval() for your account. If they're worth their salt they should be running Suhosin which has an option to disable eval.

Answer 2

You should use "disable_functions=eval,exec" in your php.ini or .htaccess as first measure.