title: Attempted php hack/inject in search AND user-agent: "print(238947899389478923-34567343546345)"
body: <p>Viewing my latest search queries I stumbled upon the below query.</p>
  
  <pre><code>d3d3lmfrdglllxnryxquzgsv"{${pr.i.nt(238947899389478923-34567343546345)}}"
  </code></pre>
  
  <p><strong>Please note:</strong> I've inserted the dots in <code>print</code> just to make sure that there's nothing evaluated in here for some reason, as I have no clue about the functioning of this query.</p>
  
  <p>The query has been made in several different formats:</p>
  
  <pre><code>d3d3lmfrdglllxnryxquzgsv");pr.i.nt(238947899389478923-34567343546345);//
  
  d3d3lmfrdglllxnryxquzgsv}print(238947899389478923-34567343546345);{
  </code></pre>
  
  <p>As the above suggests there might be more code involved which sadly aren't available for me to view at this time.</p>
  
  <p>Doing a google search for the <code>pr.i.nt(238947899389478923-34567343546345)</code> part gives a list of apparently hacked websites and a single <a href="https://www.reddit.com/r/hacking/comments/a4zcl3/interesting_search_term_attempted_hack/" rel="nofollow noreferrer">reddit thread</a> regarding this issue with only a single comment. </p>
  
  <p>Am I supposed to be worried about this, and what is the functioning of such query?</p>
  
  <p>Some background info:</p>
  
  <ul>
  <li>I'm using Wordpress, latest version</li>
  <li>Using ajax-search with a combination of the Relevanssi and SearchWP Live Ajax Search plugins - both on latest version.</li>
  <li>Wordfence security plugin is activated and updated.</li>
  <li>PHP version 7.1</li>
  <li>jQuery activated</li>
  </ul>
  
  <p><strong>UPDATE:</strong> I've also just found the same string in the person's/bot's user-agent stating the following:</p>
  
  <pre><code>aHR0cHM6Ly93d3cuYWt0aWUtc2thdC5kay8{${pr.i.nt(238947899389478923-34567343546345)}}
  </code></pre>