1

I want to run a query or script which first searches every .php file on my system for the string strawberry. If that string is found anywhere, the entire line containing it should be replaced with the string pineapple. I only have access to bash, no Ruby/Python/more flexible language.

I'm sure that there's a way to do this, but I can't figure it out. I can't even figure out the grep command to start it... grep -Rl "strawberry" . seems to return every single file in the directory, even those that don't contain the string 'strawberry' at all.

3

3 Answers 3

2

You don't really want to, and probably don't have write access everywhere.

find / -type f -name '*.php' -exec sed -i 's/.*strawberry.*/pineapple/' {} \;

If you are trying to clean up a malware infection or break-in, the proper way to do that is to bring your site off-line, fix the attack vector, harden your system, audit your scripts, and restore the rest from known-good backups

8
  • This will change the modification time on all PHP files, regardless of whether they matched the search string or not. I would consider that a major issue...
    – thkala
    Aug 23, 2014 at 6:37
  • Depends on what sort of panic you're in. I strongly suspect that the latter part of my answer is the real answer to this particular use case.
    – tripleee
    Aug 23, 2014 at 6:53
  • If you have been hacked, that's an even worse time to be mucking with timestamps blindly... Not to mention the fact that a simple search & replace will probably not a definite cure anyway...
    – thkala
    Aug 23, 2014 at 6:55
  • Why do you suspect a hacked system, anyway? The OP could just want to change the branding of their website, or something...
    – thkala
    Aug 23, 2014 at 6:57
  • And just to reiterate, you should not be doing anything at all like this then.
    – tripleee
    Aug 23, 2014 at 6:57
0

How about this?

grep -RlZ "strawberry" /srv/www | 
    grep -z '.*\.php$' |
    xargs -r -0 sed -i 's|.*strawberry.*|pineapple|'

To explain things a little, the first grep(1) invocation of the pipeline is invoked with the following options:

  • -R: recurse over directories, following any symlinks. Note the difference with -r.
  • -l: output any matching file name.
  • -Z: suffix any output file names with a zero byte. This is used to ensure that names with whitespace etc. are handled correctly.
  • /srv/www is the path to the top of the directory hierarchy that you want to search. You should avoid using / here - you probably don't want to do that, especially if you are doing this with root privileges.

The second grep filters out any non-PHP files. The -z option instructs it to use the zero byte as the line (i.e. file name) separator instead of the newline character.

The last part uses xargs(1) to execute sed(1):

  • The -r option for xargs just suppresses an error if no matching files are found.
  • The -0 option for xargs lets it know that the input items are separated by a zero byte.
  • The -i option for sed instructs it to perform an in-place replacement of the matching files.
  • Finally the substitution expression s|.*strawberry.*|pineapple| translates as "any string, followed by strawberry, followed by any string should be replaced with the string pineapple".

This however is not the most efficient way to perform this search - the first grep will happily search each and every file, rather than just the PHP files. A more efficient way would use find(1) to filter the file names beforehand:

find -L /srv/www -type f -name '*.php' -print0 |
    xargs -r -0 grep -lZ "strawberry" |
    xargs -r -0 sed -i 's|.*strawberry.*|pineapple|'

Please note the xargs/grep part - it is used to prevent files that do not contain the search string from being filtered through sed, as that would at least change their modification times and possibly create other issues. As a principle, always be as specific as possible when issuing recursive commands...

I leave the rest explanation as an exercise to the reader :-)

0
0

If you're using gawk version 4.1, you could use inplace extension with bash's globstar option to search recursively.

shopt -s globstar
gawk -i inplace '/strawberry/{$0="pineapple"}1' /dir/**
2
  • 3
    That could be written as just {print (/strawberry/ ? "pineapple" : $0)} or even /strawberry/{$0="pineapple"} 1.
    – Ed Morton
    Aug 23, 2014 at 13:10
  • 1
    Yeah, I'm going to steal that for my update. I've been known to write oddly long code when I'm tired.
    – John B
    Aug 23, 2014 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.