> In this case, str_replace() would be not only be more appropriate, it would have helped remove the risk of exploit. Actually, the exploit was a backdoor plan

> In this case, str_replace() would be not only be more appropriate, it would have helped remove the risk of exploit. Actually, the exploit was a backdoor planted by the hacker, so the system was already compromised. The recommendation to use str_replace in this instance would be useless, as it appears the victim didn't even put the code there in the first place.