Is it possible to protect PHP code without using a compiled module (.so/.dll)?
What software can help with this?
+1
A:
If you mean protect it from people being able to see the source, then its a simple matter of keeping someone out of your actual server. Whenever someone requests a PHP page it is parsed by the server and the person would get the output and not the actual PHP source.
Glenn Nelson
2010-07-03 16:34:24
"a simple matter": unless, of course, you license your code to clients who run it on their own servers.
Piskvor
2010-07-03 16:36:22
... following up Piskvor's comment: the usual goal of obfuscation is to enable other people ("customers") to run your application, without them being able to modify/enchance/change your application.
Ira Baxter
2010-07-03 16:56:02
+1
A:
You could distribute it obfuscated:
http://www.raizlabs.com/software/phpobfuscator/
However this doesn't fully protect your code, it's security through obscurity. Apart from that, I know of no way to protect your code other than run it as a paid service as supposed to distribution.
Tom Gullen
2010-07-03 16:34:58
+1
A:
There's a lot of tools to do this. Type "protect PHP" into Google.
Some encrypt your source code. This is a bad scheme; the very machinery needed to decrypt the code gets shipped with it. (There are even tools to decrypt all the known PHP encryptor products if you look hard enough.).
Some obfuscate your code, that is, make it difficult to read and understand the source code. If you code has any scale (e.g., dozens of PHP scripts working together), this can be very effective. These don't require any changes to the receiving PHP server system.
A few compile your code to PHP byte code schemes. These certainly make it hard to see the source text, but generally require the receiving system to accept pre-compiled code. The problem here is that you may have to convince the recipient to install special modules, and most PHP server sites aren't interested in changing thier configuration just for you.
I'm a obfuscator product provider, so you might not trust my opinion.
Ira Baxter
2010-07-03 16:44:11
Obfuscation can work pretty well, but some products just hash everything, like var names, and you could end up with a much bigger file size. I've also once seen a product like this, when you could easily reverse the 'encryption'
The Guy Of Doom
2010-07-03 16:48:43
Scrambling identifier names (from I1 to bz8902340892342) may make the obfuscated text larger, but has no material impact on deliverability or performance of the resulting code. Good obfuscators (well, er, ours) actually generate short scrambled names. They're just as effective. And if you have more than just 10 lines of obfuscated code (typical applications are 10-1000 pages), "easily reversing" the name encoding isn't easy.
Ira Baxter
2010-07-03 16:53:59
@Ira Baxter: From what I've seen, many PHP *programmers* have a built-in obfuscator anyway ;o)
Piskvor
2010-07-03 17:10:02
@Piskvor: So you have additional protection by hiring PHP programmers :-} I suspect the OP has already achieved that level of protection.
Ira Baxter
2010-07-03 17:15:11
@Piskvor: From what I've seen, this property isn't unique to PHP programmers.
Ira Baxter
2010-07-03 17:26:53
+1
A:
If you're serious then it has to be Zend Guard : http://www.zend.com/en/products/guard/
zaf
2010-07-03 16:58:32