title: How to detect if a string contains PHP code? PHP
body: <p>I am keeping record of every request made to my website. I am very aware of the security measurements that need to be taken before executing any MySQL query that contains data coming from query strings. I clean it as much as possible from injections and so far all tests have been successful using:</p>
  
  <p><code>htmlspecialchars, strip_tags, mysqli_real_escape_string</code>. </p>
  
  <p>But on the logs of pages visited I find query strings of failed hack attempts that contain a lot of php code:</p>
  
  <pre><code>?1=%40ini_set%28"display_errors"%2C"0"%29%3B%40set_time_limit%280%29%3B%40set_magic_quotes_runtime%280%29%3Becho%20%27-&gt;%7C%27%3Bfile_put_contents%28%24_SERVER%5B%27DOCUMENT_ROOT%27%5D.%27/webconfig.txt.php%27%2Cbase64_decode%28%27PD9waHAgZXZhb
  </code></pre>
  
  <p>In the previous example we can see:</p>
  
  <p><code>display_errors, set_time_limit, set_magic_quotes_runtime, file_put_contents</code></p>
  
  <p>Another example:</p>
  
  <pre><code>/?s=/index/%5Cthink%5Capp/invokefunction&amp;function=call_user_func_array&amp;vars[0]=file_put_contents&amp;vars[1][]=ctlpy.php&amp;vars[1][]=&lt;?php @assert($_REQUEST["ysy"]);?&gt;ysydjsjxbei37$
  </code></pre>
  
  <p>This one is worst, there is even some <code>&lt;?php</code> and <code>$_REQUEST["ysy"]</code> stuff in there. Although I am able to sanitize it, strip tags and encode <code>&lt;</code> or <code>&gt;</code> when I decode the string I can see the type of requests that are being sent.</p>
  
  <p>Is there any way to detect a string that contains php code like:</p>
  
  <pre><code>filter_var($var, FILTER_SANITIZE_PHP); 
  </code></pre>
  
  <p><em>FYI: This is not a real function, I am trying to give an idea of what I am looking for.</em></p>
  
  <p>or some sort of function:</p>
  
  <pre><code>function findCode($var){
     return ($var contains PHP) ? true : false
  }
  </code></pre>
  
  <p><em>Again, not real</em></p>
  
  <p>No need to sanitize, that has been taken care of, just to detect PHP code in a string. I need this because I want to detect them and save them in other logs.</p>
  
  <p><strong>NOTE: NEVER EXECUTE OR EVAL CODE COMING FROM QUERY STRINGS</strong></p>