Hello PhPBuilder Members,
I would like to know if this is suitable for checking for a valid licence. in this serial it expires in 1 weeks time but it also checks that the host it is registered for is the same as in the key.

The licence_key in this script is first of the host which has been encoded and the second part is the time in which it is valid till.

licenceKey.php

<?php

$GLOBALS['LICENCE_KEY'] = "bG9jYWxob3N0-1223803563";

function serialChk(){
	$KEY = $GLOBALS['LICENCE_KEY'];
	$KEY = explode("-", $KEY);
	$HOST_KEY = base64_decode($KEY[0]);
	$DATE_EXPIRE = date("d-m-Y", $KEY[1]);
	$NOW = date("d-m-Y");
	if($DATE_EXPIRE <= $NOW){
		return "INVALID_KEY";
	}
	if($HOST_KEY != $_SERVER['HTTP_HOST']){
		return "INVALID_HOST";
	}
	return true;
}

?>

keygen.php

echo base64_encode($_SERVER['HTTP_HOST']).'-'.strtotime("+1 week");

This works but I would like to know if this is good enough 🙂

    Looks valid, though, you are better than me at PHP...but anyway lol

    P.S.doesn't this belong in the "code critique" forum or something 😛

      Moved. And thanks for the twenty-year license.
      Signed:
      $GLOBALS['LICENCE_KEY'] = "d3d3LmV4YW1wbGUuY29t-1854361228";

        20 year licence haha,,, thats harsh haha,,, anyways is it good enough?

          I'm just curious.. why do this:

          $KEY = $GLOBALS['LICENCE_KEY']; 
$KEY = explode("-", $KEY);

          when you can do this?

          $KEY = explode("-", $GLOBALS['LICENCE_KEY']);

          I'm having trouble grasping the logic of assigning $KEY to $GLOBALS['LICENCE_KEY'], only to turn around and explode itself into an array...

          It's admittedly minor.. just confusing.

            bradmasterx wrote:

            anyways is it good enough?

            Good enough for what? You haven't said what all this is supposed to be for. 🙂

              Ok im making a web repack for a wow server, where you can manage everything and a site that all works togeather i want it so people have to buy a licence key by entering there domain on my site and then it will encode the host and give them the time they paid for, e.g. 1 Month, 1 Week, 3 Month, 6 Month, 1 Year.

              I actualy need it to be secure and i dont find it on a warez site saying, WoWShark CMS Repack Nulled.

                So this is running on my system, where I can change serialChk() to

                function serialChk(){
    return true;
}

                ?

                  so how i make it secure base64_encode it?

                  and thn
                  eval(base64_decode("encrypted"));

                  ??

                    Whatever you can base64 encode, I can base64 decode.

                    Your best bet may be to distribute your client side script in obfuscated form, e.g., using a tool like Zend Guard, which apparently comes with license management capability as well. (Disclaimer: I have no affiliation with Zend Technologies and have not used Zend Guard myself.)

                      but ii dont want to be paying for it

                      You can try and find an obfuscator available at zero price (but it will likely be even more easily broken), or code one yourself (but it may be beyond your current skills to design and implement it such that it poses sufficient difficulty to would-be crackers).

                      Of course, there may be other schemes as well, e.g., monitor the IP addresses of clients, and if you find that a particular license key is being used by too many IP addresses, you investigate. However, this can be futile due to dynamically assigned IP addresses, shared IP addresses, etc. You may also have a harder time than online games that are faced with a similiar problem since you may not be able to monitor the usage habits of the users to help distinguish a cheat from a genuine false positive.

                        would this world:

                        <?php
 include "http:/wowshark-server.ath.cx/validate.php?key={$GLOBALS['LICENCE_KEY']}";
?>

                        if ii had a validating function but i would need the server to allow_url_include which in the repack is enabled. if say it returns either true or false.

                          if ii had a validating function but i would need the server to allow_url_include which in the repack is enabled.

                          How is that supposed to work? What's stopping them from distributing the license key, changing the source file to ignore the authentication server, etc?

                          Note that include with url fopen wrappers does not work the same way as include on a local file system. The included file is parsed before being received.

                            yano forget it :: all my six months of coding this whole site from scratch,,, its gona be free 😛

                              Hmmm...

                              bradmasterx wrote:

                              but ii dont want to be paying for it

                              But you want your customers to pay for it, right?

                              I think it's called capital investment. 🙂

                                hey, even if it isn't free, there is always the good people who DO pay for these things....at least 40 or more &#37; of the people....never know, I might just happon to have a WOW server...if I ever become interested in playing it again 8-)

                                  Write a Reply...