making a page expire/delete itself from the server?

lukeurtnowski

I'm a freelance web designer and I was wondering if I could put page on a clients server, and the page (or certain parts of the page) would automatically be deleted unless I did something?? (like maybe a php function or something). The reason I'm asking is because sometimes peeople I do work for leave me high and dry, don't pay me and just change their password to their server.
Thanks.

LoganK

Yes, there is a way to do that, but if you have clients leaving you "high and dry", so to speak, I've think you've got more problems on your hands. Work out a legal contract with them so that they can't do stuff like, because it's extortion and not right. IANAL, but you can sue them if they do stuff like that (although that act might scare away other clients).

You might want to have a separate PHP script run via cron everyday which checks the date. And if it's "X" number of days from whenever you specify, it deletes all the main, important PHP files via unlink(), unless you give it a certain URL parameter, in which it disables itself rather than others.

I kind of like that idea - a backdoor PHP script you can use to punish bad clients.

"Bad client! Bad! Now suffer without your expensive e-commerce site that I built for you! Mwa-ha-ha-ha-ha-ha-ha-ha!!!!" /LoganK wishing he was God 😃

lukeurtnowski

Id be interested in that php function, do you know where I can get info. about creating a function which does that?
Thanks

Drakla

You could do a lot of things - if they're a member based site that stores last login times then create yourself an account, then in your cronned script, or something hidden in another part then check the login time - if you don't login for 3 months - KABOOOM!

lukeurtnowski

Welll, that sounds great, but how do I do that? Is there a tutorial or something?

lukeurtnowski

what is cron?

Drakla

it means Command Run ON - and means you can tell your server daemon to run scripts and stuff for you at set intervals. It's like Window's Task Scheduler, and is usually available in CPanel if you don't want to create 'crontabs' (which are little instruction scripts) by hand.

http://www.phpfreaks.com/tutorials/28/0.php

http://www.sitepoint.com/article/introducing-cron

http://codewalkers.com/tutorials/43/1.html

LoganK

lukeurtnowski wrote:
Welll, that sounds great, but how do I do that? Is there a tutorial or something?

Not specifically for deleteting a page when it expires. But there are tutorials on cron, as Drakla mentioned. And the basis for your "page delete" function will be the [man]unlink[/man] command.

LoganK

Just thought of something - instead of deleting the page, have the PHP "de-register" itself, or ask for activation (which only you could provide). Then it's really frustrating for the client because - it's right there, on the server, he can edit it - but you obfuscated the code beforehand, mwahahahaha!!!

lukeurtnowski

Wow, that sounds perfect, is there a tutorial or something I can use to read up on how to do this?

LoganK

Unfortunately, there is no straight tutorial for how to make logic-bombed PHP code...you'll need to develop it yourself. But if you complete it, you are welcome to make a tutorial!!

Basically, you'll want to do something like this: on the header of every PHP page, include another PHP page. This PHP page will check the current date, and find out how long it's been since a hard-coded date you specify (presumably, the date you gave the client the script). If it's been more than X number of days, and you haven't "disabled" the logic bomb, then that page deletes (unregisters, disables, etc.) all the other PHP pages you created.

jansky

well why not put a password on .htaccess ?? or in another way around before a user can browse the client site. it will ask for the username and password? YOu can create this one you can patch a login form in index.php or default.php

LoganK

I actually did some research, and this article from Wikipedia discusses logic bombs quite nicely. Especially the 4-part series linked to on the bottom; that's a definite must-read.

That said, however, both the article and series mentioned these points which you should be aware of:

 * If you create a logic bomb without the clients knowledge, and they don't pay you, and you activate the bomb, they can turn around and sue you, because it was an "undocumented feature", per se, and it could've caused damage to their systems.
 * People have gone to jail over creating logic bombs which would make their program stop working 3 months after their name goes off payroll (i.e., they're fired). Their plan was to come back in as a high-priced consultant and "fix" the code.
 * If you do create a bomb, stipulate it into the contract/license, saying it will be built-in as a security measure and *only* activated if your final payment isn't received in full, and make sure the client is aware of it.
 * Finally, if you create a logic bomb, make it disable the pages you code. Do *not* make it delete mission-critical data/files from the system; in that case, they'll sue you because it's of much more value to them. Make it so that the data is still there, but the program you built to access it is gone (or not working).

IANAL, so do not take any of this to be any sort of legal advice.

🙂

justsomeone

Hi,

I'd be happy to work on something like this with you, just for the hell of it.

Just remember, it could be a legally questionable area. I have no problem building a routine which can be used to check (somehow) for a page's current status. If/when you include that on systems you develop foryour clients, then it's up to you to make sure that your clients are aware that you're introducing this code onto their systems.

I'm not exactly sure what your situation is, but if your customers have a contractual obligation to continue to pay you, then you can dress up funcitonality like this as a licence check. if they stop paying you, then you remove the licence, and they lose the code.

If you hope to develop this an insert it into the header of every page, then it will be the work of a few moments for your client to remove the check, and you're back where you started.

You could make this better by delivering your custom functionality as a service hosted on your server rather than on theirs. ie replace internal functionality with remote webservices. Then you retain control of how long they can access that functionality.

LoganK

Or, build the entire system into the head and obfuscate all the code. Or, include the page, but have it run as a cron job just in case the client deletes it (although what client would be hiring you for PHP if he knows PHP?).

justsomeone

LoganK wrote:
what client would be hiring you for PHP if he knows PHP?

A client who could build the system, but could also make better use of their time? I can cook, sorta, but sometimes I'm happier to work late and have dinner out or delivered.

Drakla

Remember preg_replace with the e option can be quite a nasty little git for hiding the use of eval

LoganK

But you save money by doing it yourself...

Drakla - how does the e option work?

justsomeone

LoganK wrote:
But you save money by doing it yourself...

Not necessarily.

I can opt to work 3 hours overtime at $100 / hour, and pay $20 for dinner. Net cash flow for evening = $280.

I can pass on the overtime option and cook a nice fresh meal for myself, at a cost of maybe $3.50 on ingredients. Net cash flow for evening = -$3.50.

In this case, I save money by doing the extra work and paying for the more expensive dinner.

</domestic example>

If there is something more beneficial I can be doing for my business, rather than the programming of my website, and I can get someone else in to program the website, then the best use of my time may not be the programming. I might for example be:

interviewing the best new candidates to join my team
demonstrating my product at a conference
closing a deal with a customer
definding the company against some legal action
going through the companies expenses looking for savings

any one of these (or hundreds of other potential activities) could be better value use of my time than PHP coding (evn if that's what I prefer to do!)

But, we're digressing from the original point. 🙂

Drakla

EDIT: Couldn't post the example - the forum is trying to do it's own thing with it, and I'm too busy to arse about.