<?php

$servername = "mercurio-mysql";
$username = "root";
$password = "cicciopasticcio";

$dbname = "dbTimescapes";

$table = "id013_posts";
$column = "post_content";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// test one before do for all posts
//$sql = "SELECT id, $column FROM $table WHERE id = 1346";
$sql = "SELECT id, $column FROM $table WHERE id = 1179";
// query all
//$sql = "SELECT id, $column FROM $table";
$result = $conn->query($sql);


// REGEX

// remove scripts with unicode paths
$unicode = 'var *_0x';
// remove suspected function
$func = '\(function.*window\.location=';
// base64 code with eval
$evalbase='var *BDZUFIMGRY';

// start with <script
$startscript='\< *script[^\<]+';

// remove up to <\script>
$endscript = '[^\<]+\< *\/ *script *\>';

// empty script
$emptyscript='\< *script *\> *\< *\/ *script *\>';

$hackRegex = "({$startscript}{$unicode}{$endscript})|({$startscript}{$func}{$endscript})|({$startscript}{$evalbase}{$endscript})|({$emptyscript})";


if ($result->num_rows > 0) {
    // output data of each row
    while($row = $result->fetch_assoc()) {
        $id = $row["id"];
        $oldContent = $row["post_content"];

        $newContent = preg_replace(
            "/$hackRegex/",
            '', $oldContent);
        $newContent = $conn->escape_string($newContent);
        echo "$id \n";


        $update = ("UPDATE $table SET $column='$newContent'  WHERE id='$id'");

        $res=$conn->query($update);

        if($res){
            print 'Success! record updated / deleted';
        }else{
            print 'Error : ('. $conn->errno .') '. $conn->error;
        }
    }
} else {
    echo "0 results";
}
$conn->close();