Hey! Has anybody used a good obfuscator for PHP?, I've tried some but they dont work for very big projects. They can't handle variables that are included in one file and used in another, for instance.
Or do you have any other tricks for stopping the spread of your great code? :)
Why would you need an obfuscator for code that lives on your own server? (Not that there is any point to an obfuscator in any other circumstance).
Unless you're selling the code to others, why would you need to obfuscate it? It's not visible to the outside world unless you show them.
Hello and good day for everyone
You can try PHP Obfuscator from Raizlabs and you can get in on http://www.raizlabs.com/software/phpobfuscator/
the keys ? Encode and obfuscate PHP code, functions and variables
Exclude particular variables, functions or files from obfuscation and encoding
Process large projects with command line tools and project files
Open source and 100% free
Thats all. With no more.... bye bye
People will offer you obfuscators, but no amount of obfuscation can prevent someone from getting at your code. None. If your computer can run it, or in the case of movies and music if it can play it, the user can get at it. Even compiling it to machine code just makes the job a little more difficult. If you use an obfuscator, you are just fooling yourself. Worse, you're also disallowing your users from fixing bugs or making modifications.
Music and movie companies haven't quite come to terms with this yet, they still spend millions on DRM.
In interpreted languages like PHP and Perl it's trivial. Perl used to have lots of code obfuscators, then we realized you can trivially decompile them.
perl -MO=Deparse some_program
My advice? Write a license and get a lawyer. The only other option is to not give out the code and instead run a hosted service.
See also the perlfaq entry on the subject.
Thanks for the answers.
We are a small company so we don't have a server, but maybe thats worth looking at soon, it should solve the problem.
Yeah I don't like to obfuscate and sell the code either. I guess it isn't a real problem if you have a license.
I tried the raizlabs, was not satisfied. Guess I've made a framework that they cant handle.
I think the main player in this area is ionCube, which is also first (paid) results in Google: http://www.ioncube.com/sa_encoder.php
I would like to echo Schwern's comment about not being able to fix bugs and make modifications. If you're planning on selling/supporting your software, the obfuscation will just make your life hell as you'll be really limited in any sort of debugging you can do on a live server.
free ones at: http://www.voormedia.com/en/tools/html-obfuscate-scrambler.php
quite good.
Try this one: http://www.pipsomania.com/best_php_obfuscator.do
Recently I wrote it in Java to obfuscate my PHP projects, because I didnt find any good and compatible ready written on the net, I decided to put it online as saas, so everyone use it free. It does not change variable names between different scripts for maximum compatibility, but is obfuscating them very good, with random logic, every instruction too. Strings... everything. I believe its much better then this buggy codeeclipse, that is by the way written in PHP and very slow :)
See the SD Thicket PHP Obfuscator for an obfuscator that works just fine with arbitrarily large sets of pages.
Yes, it obfuscates identifiers identically across pages; if it didn't do that, the result wouldn't work.
Obfuscation is only adding another layer of potential bugs and security vulnerabilities to your program. Please don't do it.
The kind of people who write obfuscation software usually seem very sketchy and non-skilled anyways...
If your code is "great", crackers will go through great lengths to spread it, regardless of weather or not it is obfuscated. If nobody knows/cares about your code, they probably wont, either.
Nothing will be perfect. If you just want something to stop non-programmers then here's a little script I wrote you can use:
<?php
$infile=$_SERVER['argv'][1];
$outfile=$_SERVER['argv'][2];
if (!$infile || !$outfile) {
die("Usage: php {$_SERVER['argv'][0]} <input file> <output file>\n");
}
echo "Processing $infile to $outfile\n";
$data="ob_end_clean();?>";
$data.=php_strip_whitespace($infile);
// compress data
$data=gzcompress($data,9);
// encode in base64
$data=base64_encode($data);
// generate output text
$out='<?ob_start();$a=\''.$data.'\';eval(gzuncompress(base64_decode($a)));$v=ob_get_contents();ob_end_clean();?>';
// write output text
file_put_contents($outfile,$out);