Question: There is a theme hack or a worm circulating online which adds this code to all functions.php files. It happened to me on my local server.

Here's the code - <http://pastebin.com/AUsHUng1>

How do I find the theme hack that creates it? Or the worm?

**UPDATE:**

I have found that this line:

```
$elem == substr(__FILE__,-13)){

```

checks for the **functions.php** file (as it's the only one having 13 letters and using file) and by using the `fputs()` functions writes itself on all **functions.php** files.

I have deleted all the instances of the code, and, hopefully, it will not replicate itself on another theme activation. I have a local server with about 60 themes.

I still haven't found the original theme that carried the code.

**UPDATE AND SOLUTION:**

Clean all the malicious code (see my PasteBin link above) from all **functions.php** files (best to check globally using a text editor like Notepad++) and you're done. Check all downloaded themes for the code in **functions.php** file. There are more themes infected with this code online.

Answer: 
I can see several possibilities for this one.

First, I am not convinced that that you can't use `pre_get_posts` though maybe you'd have to reorganize your code. You don't have to wait for your theme template to use `$_GET`. Try:

```
function tst() {
    // global $_GET; // sometimes necessary
    var_dump($_GET);
}
add_action('pre_get_posts','tst');

```

So I think something like:

```
function finder_sort($query) {
    // I don't know what your complete code for processing $_GET is but
    // that would go here and set $pin
    if ($query->is_main_query() && is_tax(array('location_type')) && isset($_GET['finder_action'])) {
        $query->set('post__in', $pin);
    }
}
add_action('pre_get_posts','finder_sort');

```

That is one possibility, and from where I sit right now looks like the best one. If for some reason that isn't possible you can always do something like:

```
$locations_found = wp_list_pluck($locations, 'id');
while(have_posts()) {
    the_post();
    if (in_array($post->ID,$locations)) {
        echo '<tr>';
        finder_location_teaser_table();
        echo '</tr>';
    }
}

```

I am assuming some things about your data. Your question doesn't have all of the necessary information for me to write code with 100% confidence but that is the idea.
### Don't rely on `$_GET`

I would recommend, instead of relying on `$_GET` data, to add your custom query parameters to the `$query` object, using [**`add_query_arg()`**](http://codex.wordpress.org/Function_Reference/add_query_arg), and then retrieve that value using [**get\_query\_var()**](http://codex.wordpress.org/Function_Reference/get_query_var).

Say, for example, you've got a query variable `'foo'`, with a value of `'bar'`, such that:

```
`$_GET['foo'] = 'bar'`

```

You could make that key/value pair available to the `$query` object, like so:

```
add_query_arg( 'foo', 'bar' );

```

Do that wherever it is that you're currently appending `&foo=bar` to the URI.

Now, you can retrieve the value of `'foo'` like so:

```
$foo = get_query_var( 'foo' );

```

### Using `pre_get_posts`

Since you now have a way to retrieve your URI query value independent of `$_GET`, you can use that method inside of a `pre_get_posts` callback:

```
function finder_sort( $query ) {
    if ( $is_main_query() && is_tax( array( 'location_type' ) ) && isset( get_query_var( 'finder_action' ) ) ) {
        $query->set( 'post__in', get_query_var( 'finder_action' ) );
    }
}
add_action( 'pre_get_posts','finder_sort' );

```