Search directory for PHP files containing malicious code

search_for_malicious_php_code.sh

## eval() is used to executed shell commands through PHP
grep -ri "eval(" $PWD --include *.php

## exec() is used to executed shell commands through PHP
grep -ri "exec(" $PWD --include *.php

## Malicious code is often obfuscated through base64 encoding
grep -ri "base64" $PWD --include *.php

## Malicious code is often obfuscated through gzip
grep -ri "gzinflate" $PWD --include *.php