What PHP code protection tool would you recommend? (encoding/encrypting/obfuscating/etc)

Question

I have a client that is going to start selling a software based on PHP, and he'd like to have some level of piracy protection.

We're going to have a basic licensing code check, but we need the code to not be plain-text so that anyone can't go in and comment it out.

I've found a lot of "encoding/encrypting/obfuscating" tools.

Some are Zend Guard, ionCube, phpShield, etc.

Have you had experience with any of these?
Which one would you recommend?

I'd like to have something that's as easy to use and to integrate into a deployment process as possible.

UPDATE: I know that anything can be broken provided enough time or resources. I don't need the perfect solution, I need something that's going to make a pirate's life hard enough. Also, this is not "mass" software. I justneed to make sure it's at least non-trivial to steal.
That's why i'm asking for experiences with these particular types of tools. I know they're not impossible to break, I just want to hear if you've had any problems or success stories with them.

Answer 1

I've relied on Source Guardian for years. Nobody can break it from what I can tell because it runs your PHP scripts in a compiled state. Plus, it has a side benefit of actually making your code run faster, with reduced execution times.

Answer 2

Short answer: This can't be done effectively.

Long answer: Whatever protection you put in your code, it can be removed with little difficulty by anyone with some experience in PHP. Additionally, you should let your client know of problems this introduces:

• Code that's harder and more expensive to maintain;
• Lost revenue because of customers who can't install extensions;
• Potential privacy issues if you have code that "phones home";
• ...

As you should well know, software piracy is a common problem. This is aggravated in PHP because PHP is interpreted and advertising "compiling to bytecode" as a protection measure is misleading. Even when the code is encoded with something like ionCube or Zend Guard, this too can be decoded with some effort.

Your client's best option is to protect their intellectual property by actively pursuing copyright infringers. But even this is not foolproof, as our folks from RIAA and MPAA know very well (or in the PHP world, Jelsoft and IPS).

I know this is not what you wanted to hear, but it's the (painful) truth.

Answer 3

I'd suggest to sell a service rather than naked code.
I doubt anyone would be really interested in your code. There is plenty of open source code already and some of it with decent support.
While there are much more customers who need not a code itself but service - installation, customization, support. It's much more profitable in my opinion.

And yes, all these attempts to protect your code in vain. And it would make your sales even worse: I would never buy a code I can't customize or control.

Answer 4

We're using ionCube for some sites and it works like a charm. Easy to setup, easy to encode (part of) your files and great value for money.

Answer 5

Do not attempt to sell code based on interpreted or scripting languages with expectations of sales exclusivity for the code alone. It will be decoded, unobf'd/RE'd and used without your consent if it is worth the time/effort/cost to decode and unobf/RE it. You will likely not even know about it when it has happened. At least with compiled languages and a strong license agreement you have some decent protection, both technically and legally, from competitors poaching your code. You still face the issue of non-paying users though and PHP is no exception to that rule either in addition to being very weak to poaching as well.

Encoding PHP with extensions is akin to leaving the keys in the ignition of your unlocked car with a note taped to the steering wheel stating "please do not drive away in this vehicle". Pointless. And a waste of paper.

PHP is free and is nothing more than an open scripting language. Might as well keep it that way by choice lest you be let down when someone else reminds you of it firsthand. Sell "you" and "what you can do with PHP" rather than treating a system of scripts like it is a standalone product that can be sold and marketed because it can't be unless you're dealing with very simple, not-so-resourceful people who are unable to use, or find someone they can pay to make use of, your raw, unencoded PHP in the first place.

Programmers familiar with PHP can and will access anything you've done if they have the encoded .php files locally available to them to run the specific decoder on. This is not new but years old. There are also services that will batch decode PHP for very little ($2/kb) which makes it very difficult for you to hold any script(s) hostage if you're dealing with clients that have so much as the ability to use google. The ones for sale (Zend, ionCube, CodeLock, etc.) are all broken. They sell you the encoding then decodezend.com or some such site sells your client, whom you were trying to keep the script(s) from, the decoding service. Everyone wins as long as they are in the encoding or decoding spectrum of the arrangement. You, however, lose and waste time doing so.

Monetize deployment, config, continual support and updates, etc (SAAS). That is what you really have to focus upon to turn the blood, sweat and tears into profit. Don't put your script on a server outside of your control until the check clears, because once you do, it's really already theirs whether it is encoded or not. PHP is inherently hard to pilfer unless you have access to the .php files and accompanying MySQL config in the first place. Charge for that access.

IMO, if you have successfully protected a PHP script and it hasn't been decoded yet it's likely because you missed the already existing and freely available script/system/tutorial that does the same or very similar things before you began the project. Hence, the whole thing you're trying to protect may not have even needed to have been developed from scratch, let alone does it really need protected. PHP has matured to where it seems everything has already been done at least once, it is thoroughly-documented and is out there for the taking, and can be used at the very least as a base upon which you can build for your specific needs. This beautiful side of PHP that makes it so easy for you to build on others' work is also the ugly side which makes it equally easy for the next guy to do the same with yours.

TL;DR Version: PHP is too open to successfully monetize the code. It was designed to be this way. SAAS. SAAS. SAAS. Also, SAAS.