free way to protect sourcecode?

madhavr

hi all

i suspect someone of trying to get a hold of my source code

i want to protect it

i have tried zend encoder demo version which worked fine for a while but then stopped working after a few days

i need a free open source solution to this problem

please make any suggestions

thanks

wilbur

Hi,

POBS, stands for PHP Obfuscator/Obscurer, is a free and open PHP program that makes PHP sourcecode almost impossible to read and edit for ordinary users. It is a simple way to protect your PHP sourcecode from people who whould like to adjust it or who would like to know the inner workings of it. It allows you to deploy your application and feel pretty safe about it. POBS works by replacing User-defined functionnames, variables and constants with a MD5 key of 8 characters. It really removes information that humans would like to have but computers don't care about. It's not ideal but quite a good option in my idea. Advantages include: Really removes information from your sourcecode; Hard to reverse-engineer; Cross-platform, cross PHP version; Open Source. So it can be adjusted to your own needs; Works with PHP cachers like APC and ZEND Cache; and Works with Zend Encoder.

http://www.hotscripts.com/PHP/Scripts_and_Programs/Security_Systems/more3.html

try this.

olly2111

I thought PHP was server side so the user couldnt read the code?
If this is the case why would u need to encrypt it?
Or am i missing something?

wilbur

to be honest, I thought exactly the same. But... its easy. Take a look at this:

http://hurring.com/code/php/view_source/

http://www.zend.com/codex.php?id=203&single=1

I need to take a look at this - and understand how it works - but it seems its simple.

stolzyboy

this is only gonna work on a server that you put those files on, and if someone has access to ftp to your server you have more problems than someone viewing your source code

wilbur

Stolzyboy, Madhavr

Any idea as to exactly why individuals might feel the need to protect their PHP code on the server?? Does this simply mean they are protecting it from someone with access to the server they are using??

thanks,

stolzyboy

apparently, since when you run the page thru the browser all it is is html, not any php code anyway, but if someone has access to the comp via ftp, it probably won't do any good, unless you use a compiler type program like described above, but other than that, noone is going to know what you are truly doing in your php

wilbur

thanks.

madhavr

yes i meant someone i suspect who does have direct access to the server.

the kind of thing i am looking for is something that directly coverts php source into a sort of encryptable byte-code sort of like java but none de-compilable!

i will take a look at the above suggestions

many thanks

trooper

Well if someone has access to the code via ftp then your problem is more one of securing the ftp than the code

madhavr

no the problem is not ftp'ing

the system i created is for a local intranet the guy who i suspect is the network admin.

even though he acts all mr nice guy i dont trust him.

he has access to all dirs on all machines including the machine running apache and php but he has no ideas about where the files are located but i just wanted to encypt the files so he cant do anything with my code or hire someone else too.

thanks for all the comments everyone - much appreciated!

hopefully i will get it encypted soon

stolzyboy

if you have to worry about someone that much, you should just go ahead and get someone else anyway, you shouldn't need to protect source code from someone in your own organization

emubilover

i have similar concern as madhavr, as I am going to rent a space from web hosting services and I have some major concern on how to protect my clients' information. Obviously one of the concern is that I do not want server admins to read my PHP code and find out where and what information is in the database.

stolzyboy

paranoia strikes back again

"Remember, just because you aren't paranoid, doesn't mean they aren't watching you."

jimson

encrypt your code and store in in the database,
decrypt and eval() them to get it runs.

stolzyboy

that may help for awhile, but if he has ftp access, he will likely be able to use mysql, and if not, he can just put phpmyadmin up there and peruse the mysql database at his leisure anyway

jimson

can we encrypt all files.. as well as the files to decrypt

KendersPlace

madhavr - I feel your pain. 😉

I've asked this question in many circles and people just don't get it. I always get responses like "Use a firewall" or "Disable FTP" or whatever.

People apparently don't understand this situation.

Consider a company that hires you and pays you to write a PHP application for them. This application is loaded up on THEIR server running Linux/Apache/whatever. They have their own tech staff - tech staff that you don't want to go copy the code that YOU wrote and go off distributing it to their buddies.

This is no big deal if you're writing 3 lines of PHP code to run a hit counter or something, but if you pour 6 months of your life into producing a professional software product that is sold to the client under LICENSE (you don't just sell your source code, but rather a license to use it) - you may want to sell this application again to another customer down the road. This is impossible to do if it's already been copied and posted all over the web.

Thus the need to encode it.

I have been looking at Zend Encoder for this very reason. It's not free, but it looks pretty good. The eval only lasts 3 days. But... you can purchase the full working copy under their "Small Business Program" for under $300, the only catch is that you can't make more than $250,000 per year gross by developing software - not a problem for most of us "small timers". This may be the best solution for your needs.

Hope that helps.

Weedpacket

This question is asked here so often it's now mentioned in the forum's FAQ.