Check WP-Scripts for "uncommon" code

<?php
if (session_status() === PHP_SESSION_NONE) {
    ini_set('ignore_repeated_errors', TRUE);
    ini_set('display_errors', FALSE);
    ini_set('log_errors', TRUE);
    ini_set('error_log', 'errors.txt');
    ini_set('log_errors_max_len', 1024);
    ini_set('set_time_out',500);
    error_reporting(E_ALL);
    session_start();
    $_SESSION['monitoring']=1;
}
$ausgabe = array();
if (!empty($_REQUEST['typ']) && isset($_REQUEST['typ']))
{
    $par = strtoupper(trim(strip_tags(stripslashes($_REQUEST['typ']))));
    $par = explode(",",$par);
} else $par = array('A','B','C','D','E','F');

if (isset($_REQUEST['sub']))
{
    $maxDepth = (int)($_REQUEST['sub']);
} else $maxDepth = -1;



$basedir =
$directory = './'; // Current directory
echo '<h3>vMon - PHP auf potentielle Schwachstellen untersuchen</h3>
<p>maximale Such-Tiefe: '.($maxDepth==-1?"unbegrenzt":$maxDepth).'</p>

<p>Parameter:
<br>- sub=[Verzeichnis-Tiefe] (Default: alle Dateien)
<br>- typ=[A-F] (Default: alle Typen)</p>';
flush();

function getFilesInDirectoryAndSubdirectories($dir, $maxDepth = -1, $currentDepth = 0) {
    if ($maxDepth>-1 && $currentDepth > $maxDepth) {
    return [];
    }
    $files = [];
    if ($dir!="./stats" && $dir != './awstats' && $dir != './cgi-bin' && $dir != './logs')
    {
        $iterator = new DirectoryIterator($dir);
        foreach ($iterator as $file) {
            if ($file->isDot()) continue;
            if ($file->isFile()) {
                $files[] = $file->getPathname();
            } elseif ($file->isDir()) {
                $subFiles = getFilesInDirectoryAndSubdirectories($file->getPathname(), $maxDepth, $currentDepth + 1);
                $files = array_merge($files, $subFiles);
            }
        }
    }
  return $files;
}

function h($d) {
    return str_replace(basename($d),'<b style="color:#00f;">'.basename($d).'</b>',$d);
}

function verlinkung($d) {
    global $basedir;
    $x = str_replace(basename($_SERVER['REQUEST_URI']),"",$_SERVER['REQUEST_URI']).str_replace(array("\\",$_SERVER['DOCUMENT_ROOT']),array("/",''),($d));
    $x = str_replace($basedir,'',$x);
    return $x;
}

function genLine($typ,$filePath,$fdate,$fsize,$pat,$hit,$ln) {
    $s = '<td>'.$typ.'</td>';
    $s .= '<td style="color:#666666;">'.h(verlinkung($filePath)).'</td>';
    $s .= '<td>'.$fdate.'</td>';
    $s .= '<td>'.$fsize.'</td>';
    if ($hit==0)
        $s .= '<td colspan="2">'.$pat.'</td>';
    else {
        $s .= '<td>'.$pat.'</td>';
        $s .= '<td>'.$hit.'</td>';
    }
    $s .= '<td>'.$ln.'</td>';
    return $s;
}

$files = getFilesInDirectoryAndSubdirectories($directory, $maxDepth);
echo '<h4>Durchsucht: '.count($files).' Dateien</h4>';
echo '
 <p>A findet $GLOBALS[$var] (potentiell unsicher, Fall zu Fall prüfen)
<br>B sucht ungewöhnlichen Auskommentierungen /* &hellip; */
<br>C findet Zuordnungen von Globals, die verdächtig sind
<br>D findet (@)includes mit Variablen als Namens-Übergabe
<br>E findet ungewöhnlichen Zeichen-Kodierungen wie chr(&hellip;)
<br>F findet Null-Byte-Files
<br>&nbsp;</p>
<p><B>Wichtig!</B> Natürlich sind nicht alle Funde Malware.<br>Oft ist der Code drum herum entscheidend, ob ein Konstrukt problematisch oder gar gefährlich ist.<br>Aber das Script zeigt potentielle Schwachstellen auf, die zu prüfen sich lohnt.</p>';
flush();

foreach ($files as $file) {
    if ($file != '.' && $file != '..' && !strpos($file,".gz")
    && (strpos($file,".php")||strpos($file,".css")||strpos($file,".scss")||strpos($file,".png")||strpos($file,".js"))
    && is_file($directory . $file)
    && basename($file)!='vmon.php'  ) {
        $filePath = $directory . $file;
        $date = date("Y-m-d H:i:s", filemtime($filePath));
        $size = filesize($filePath);

    if (in_array("F", $par)){
        if ($size==0 && basename($filePath)!="index.php") {
            $out = '<tr class="c6">';
            $out .= genLine('F',$filePath,$date,0,'0-Byte-File',0,$zeile);
            $out .= '</tr>';
            $ausgabe[] = $out;
            continue;
        }
    }

    $lines = explode("\n",file_get_contents($filePath));
        $t = -1;
        $zeile = 0;
        foreach ($lines as $line) {
            $zeile ++;
            $line = str_replace('/***/','',$line)."\n";
            $t = strpos($line,'$GLOBALS[');
            if (in_array("A", $par) && $t !==FALSE && substr($line,$t+9,1)!='"' && substr($line,$t+9,1)!="'") {
                $firstOccurrence = htmlentities(substr($line,$t,30));
                $out = '<tr class="c1">';
                $out .= genLine('A',$filePath,$date,$size,$firstOccurrence,0,$zeile);
                $out .= '</tr>';
                $ausgabe[] = $out;
            }
            elseif (in_array("B", $par) && preg_match('#\/\*\w+\s\*\/#', $line, $matches)) {
                $firstOccurrence = htmlentities($matches[0]);
                $out = '<tr class="c2">';
                $out .= genLine('B',$filePath,$date,$size,$firstOccurrence,sizeof($matches),$zeile);
                $out .= '</tr>';
                $ausgabe[] = $out;
            }
                        elseif (in_array("C", $par) && preg_match('#\$(.*?)\s=\s\$GLOBALS(?:\s|;)\s*#', $line, $matches)) {
                $firstOccurrence = htmlentities($matches[0]);
                $out = '<tr class="c3">';
                $out .= genLine('C',$filePath,$date,$size,$firstOccurrence,sizeof($matches),$zeile);
                $out .= '</tr>';
                $ausgabe[] = $out;
            }
            elseif (in_array("D", $par) && preg_match('/@?include\s*\(\s*(\$\w+)\s*\)/', $line, $matches)) {
            $a = strpos($line, "include");
            $firstOccurrence = htmlentities(substr($line, $a, 30));
            $out = '<tr class="c4">';
                $out .= genLine('D',$filePath,$date,$size,$firstOccurrence,sizeof($matches),$zeile);
            $out .= '</tr>';
            $ausgabe[] = $out;
            }
            elseif (in_array("E", $par) && preg_match('/chr\((\w+)[-](\w+)\)/', $line, $matches)) {
                $firstOccurrence = htmlentities($matches[0]);
                $out = '<tr class="c5">';
                $out .= genLine('E',$filePath,$date,$size,$firstOccurrence,sizeof($matches),$zeile);
                $out .= '</tr>';
                $ausgabe[] = $out;
            }
        }
    }
}

if (sizeof($ausgabe)>0)
{
    sort($ausgabe);
echo<<<hd
<style>
td a{color:#000 !important}
.c1{background-color:#ff9999}
.c2{background-color:#99ff99}
.c3{background-color:#9999ff}
.c4{background-color:#ffff99}
.c5{background-color:#99ffff}
.c6{background-color:#ff99ff}
</style>
<table border="1"><tr><th>TYP</th><th style="width:300px;">Name</th><th>Datum/Zeit</th><th>Größe</th><th>Muster</th><th>Treffer</th><th>Zeile</th></tr>
hd;
    foreach($ausgabe as $zeile) echo $zeile;
    echo '</table>';
} else echo "Keine Treffer";