Clean infected php files with eval(base64_decode()) functions - usually in wordpress

clean-infected-files.sh

#!/bin/bash

find . -name "*.php" -type f -exec sed -i 's/<?php \/\*\*\/ eval(base64_decode(\"[a-z0-9A-Z\/\+]*\"));?>//g' {} \;

# or
find . -name "*.php" -type f -exec sed -i 's/<?php \/\*\*\/ eval(base64_decode(\"[^"]*\"));?>//g' {} \;

Does it change file on disk ?
Do you know any other solution to show only the infected files without editing them ?
Regards from Italy

@borgogelli

the -i flag on sed indicates that it will insert the changes into the file. so yes