0

I recently detected on my cousin's blog a few click-jack links. I was alarmed because I immediately said to myself that I had some crappy adware on my browser... However I didn't. The links on the picture didn't even work.

On her computer and the links were working. I opened Chrome Extensions and there was some suspicious stuff there. After removing everything the links stopped working too.

I went to the database and saw this:

enter image description here

So apparently the Wordpress installation was not compromised and it was just the Chrome Extensions adding extra HTML to the post.

My Question: Is there a way in SQL I can remove all those links?

The ideia is to find the word DiscountMan and look for an anchor tag before that and the closing after and remove the tag, but leave the word on the middle intact.

<a class="garehbqm" title="Click to Continue &gt; by DiscountMan" href="#10518549"> lifestyle<img src="http://cdncache-a.akamaihd.net/items/it/img/arrow-10x10.png" alt=""></a>

The link and the image tag should be removed, however anything else inside the tag, like lifestyle (space before) should be kept.

Note: I can remove the img tag with this:

UPDATE table SET fieldname=REPLACE(fieldname,'<img src="http://cdncache-a.akamaihd.net/items/it/img/arrow-10x10.png" alt="">','');

But I don't know how to solve the link issue.

Thank you.

TCB13
  • 3,067
  • 2
  • 39
  • 68

1 Answers1

1

Can you Switch to MariaDB instead of MySQL? It has a REGEXP_REPLACE build-in. With it you can do a 

SELECT REGEXP_REPLACE(fieldname, "(<a .* title=\\".*DiscountMan\\"[^>]*>)([^<]*)(<img [^>]*><\/a>)", '\\2')

See this post.

You can test it on enter link description here

Community
  • 1
  • 1
Benvorth
  • 7,416
  • 8
  • 49
  • 70