The dubious links have finally been cleaned up from my blog’s feeds. A search reveals none of the key words (e.g. loans, ringtones, porn) that were there before, so all evidence points to things being back to normal.

For the record, I tried to clean things up manually at first, but that quickly became an awful chore: more then 200 posts had been magically “edited” and the nefarious links inserted at the end. So I wrote a script to clean things up, using Ruby and Sequel:

require 'rubygems'
require 'mysql'
require 'sequel'

db = Sequel.mysql 'inquirylabs_wordpress',
  :user => 'user',
  :password => 'password',
  :host => 'localhost'

posts = db[:wp_posts]
posts.all.each do |p|
  posts.filter(:ID => p[:ID]).update(
    :post_content => p[:post_content].gsub(
      /(<font|<div\sid=wp_internal).*
        (porn|
         payday[-\s]loan|
         home[-\s]loan|
         ringtone).*$/x, "")
end

Much better.

Thanks to those of you who helped me to identify the problem and, recently, to see that I hadn’t scoured all of the dark corners of the website.