A script that only will only run on one domain?

Gump

Is there a way to make a script that will not run if it is installed on a domain other than the one it has been licensed to?

I tried a search but wasnt sure of what I should be looking for.

Thanks!

HalfaBee

You can check the $_SERVER['SERVER_NAME']
variable to make sure it is the correct site.

Of course this is not much good unless you encode it somehow.

You can use zend encoder as one way.

I have also seen scripts written using hexcode and eval()ed to make it harder to find out what is happening.

HalfaBee

Gump

Thanks for the reply. Actually I was going to use something similar. I want to keep most of the script open so they can edit it, but simply dont spread it around among all their friends without a licence.

I assume I could simply make an include like:

include("encrypted-file.php"); on say the second line of the script,

then in the encrypted-file.php have this one line of code:

$_SERVER[whateveer.com'] encrypted?

Would that work?

Thanks!

HalfaBee

Seems like the way to go.
Do a md5 hash of the servername with an extra series of letters to hide the servername.

Of course if they want to spread it around they will 🙁

HalfaBee

superwormy

The Zend Encoder provides this ability... but whichever file you encrypt won't be editable after you encode it...

Ravenous

Just require a file that is above the web root. They won't be able to download it and they won't be able to run the script without it so long as it contains vital information.

Gump

I dont think that will work for many server setups that run open_basedir, could be wrong tho.

superwormy

I know what ya should do, use the Zend Encoder ( or another similar obsfuciation / encoding product ) to encode just one vital file.

That one vital file can have important stuff it in, functions, classes, AND the thing that restricts it to a certain domain ( if ($_SERVER['HTTP_HOST'] == "whatever.com") )

include() that file, that way your app won't work without that file, cause it needs the functions, so you have to include the file which has the HTTP_HOST checker.

Actually, probably the better thing to do than checking what HTTP_HOST is equal to, is to check for stristr ($_SERVER['HTTP_HOST'], "whatever_domain_they_registered_it_under") because that covers [url]http://www.http_host.com,[/url] [url]http://http_host.com,[/url] [url]http://the-other-subdomains.http_host.com,[/url] etc.

Gump

Holy smokes.

Okay I was loosing sleep again thinking the same, include more than just the domain, as they could simply delete the include to the domain check.

Your solution is much better. I have to think about it a bit more. I am a green horne in this field, but that sounds like a good call.

Thanks all.

This community rox!