Minify / Obfuscate PHP Code

Question

Hi,

I use haXe to generate php code. (This means you write you code in the haXe language and get a bunch of php files after compiling.) Today a customer told me that he needs a new feature on a old project made with haXe. He also told me that he altered some small things on the code for his own needs. Now I first have port his changes to my haxe code and then add the new feature, because otherwise his changes will be overwritten by the next time I compile the project.

To prevent that this happens again I am looking for some kind of program that minifies / obfuscates the PHP code. The goal is to make the code unreadable / uneditable as possible.
The ideal tool would run under Linux and could process whole folders and all it containing files.

Anybody any suggestions?

Answer 1

We use Zend Guard to encode our PHP code with certain clients, but as Parrots said, you need to be sure you own the code. We only encode in certain situations, and only when it's explicit that we retain ownership of the code, otherwise Parrots is right, the client has a right to modify it.

Answer 2

I know of Zendguard, Expressionengine used it to encrypt their trial version's core code. You could always give that a go although you need to pay for it.

However, while I understand the frustration of having to port his changes, I assume they purchased the code from you? They have the right to modify it. You just have the right to charge them extra to port their changes ;) Imagine if you stopped working for them, how could they ever hire someone else to update the code?

Answer 3

I agree with the comment, what you are doing is very underhanded, but after 10 years in this biz I can attest to one thing: Half the code you get is so convoluted it might as well have been minified, and really function/var names are so often completely arbitrary, i've edited minified js and it wasn't much more of a hassle than some unminified code.

I couldn't find any such script/program, most likely because this is kind of against the PHP spirit and a bit underhanded, never the less.

First: Php isn't white space sensitive, so step one is to remove all newlines and whitespace outside of string.

That would make it difficult to mess with for the average tinkerer, an intermediate programmer would just find and replace all ;{} with $1\n or something to that effect.

The next step would be to get_defined_functions and save that array (The 'user' key in the returned array), you'll need to include all of the files to do this.

If it's oo code, you'll need get_defined_classes as well. Save that array.

Essentially, you need to get the variables, methods, and class instances, you'll have to instantiate the class and get_object_vars on it, and you can poke around and see that you can get alot of other info, like Constants and class vars etc.

Then you take those lists, loop through them, create a unique name for each thing, and then preg_replace, or str_replace that in all of the files.

Make sure you do this on a test copy, and see what errors you get.

Though, just to be clear, there is a special place in hell reserved for people who obfuscate for obfuscation's sake.

Check out: get_defined_functions get_declared_classes and just follow the links around to see what you can do.

Answer 4

You can try PHP Obfuscator or the bcompiler PHP extension.

Answer 5

The SD PHP Obfuscator does exactly the the job of stripping comments, whitespaces, and scrambling identifiers.