how to block these php code using mod_security

ModSecurity cannot block requests based on the content of the file that is being requested unless you use response body filtering.

The main thing is to prevent compromise in the first place with a good rule set and your users keeping their CMS software updated. I know compromises will always happen some percentage of the time especially if you host a lot of sites, but trying to prevent access to the php shells after the fact is kind of a moot point; you need to determine the method of hack (bad/weak/compromised password, old vulnerable plugin, etc), then restore a known good backup, and patch the initial issue (update it, new passwords, etc.).