Protect PHP source code

Question

due to bad internet bandwidth in my country, the client wishes for me to install my PHP/MySQL application on his Windows server or a Linux server.

What is the best way to protect the source code? Or the folder where the PHP source code resides. The client should be able to use the rest of the server freely.

Thank you. Cyril

what do you want to protect it from? are you saying client should not be able to read the code, or execute it, or something else? — eis
– eis, Commented Mar 28, 2014 at 7:55
Protect it from copying, modifying and reading. The client should only execute the php files. — Cyril Joudieh
– Cyril Joudieh, Commented Mar 28, 2014 at 9:48

WhiteLine · Accepted Answer · 2014-03-28 07:56:18Z

you could use a code obfuscator

this is an example

though (with great difficulty) the code could be re-converted, but at least make the code more difficult to read

example 1

<?php
    echo phpinfo();
?>

would turn into something like this

<?php $XnNhAWEnhoiqwciqpoHH=file(__FILE__);eval(base64_decode("aWYoIWZ1bmN0aW9uX2V4aXN0cygiWWl1bklVWTc2YkJodWhOWUlPOCIpKXtmdW5jdGlvbiBZaXVuSVVZNzZiQmh1aE5ZSU84KCRnLCRiPTApeyRhPWltcGxvZGUoIlxuIiwkZyk7JGQ9YXJyYXkoNjU1LDIzNiw0MCk7aWYoJGI9PTApICRmPXN1YnN0cigkYSwkZFswXSwkZFsxXSk7ZWxzZWlmKCRiPT0xKSAkZj1zdWJzdHIoJGEsJGRbMF0rJGRbMV0sJGRbMl0pO2Vsc2UgJGY9dHJpbShzdWJzdHIoJGEsJGRbMF0rJGRbMV0rJGRbMl0pKTtyZXR1cm4oJGYpO319"));eval(base64_decode(YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH)));eval(ZsldkfhGYU87iyihdfsow(YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH,2),YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH,1)));__halt_compiler();aWYoIWZ1bmN0aW9uX2V4aXN0cygiWnNsZGtmaEdZVTg3aXlpaGRmc293Iikpe2Z1bmN0aW9uIFpzbGRrZmhHWVU4N2l5aWhkZnNvdygkYSwkaCl7aWYoJGg9PXNoYTEoJGEpKXtyZXR1cm4oZ3ppbmZsYXRlKGJhc2U2NF9kZWNvZGUoJGEpKSk7fWVsc2V7ZWNobygiRXJyb3I6IEZpbGUgTW9kaWZpZWQiKTt9fX0=684ec3cc57884cf14d34c372f3ab886384a059a3S03OyFcoyCjIzEvL19C0BgA=

example 2

<?php
for( $i = 1; $i <= 10; $i++ ) {
    echo( '5x'.$i.'='.(string)($i*5)."\n" );
}
?>

would turn into something like this

<?php $XnNhAWEnhoiqwciqpoHH=file(__FILE__);eval(base64_decode("aWYoIWZ1bmN0aW9uX2V4aXN0cygiWWl1bklVWTc2YkJodWhOWUlPOCIpKXtmdW5jdGlvbiBZaXVuSVVZNzZiQmh1aE5ZSU84KCRnLCRiPTApeyRhPWltcGxvZGUoIlxuIiwkZyk7JGQ9YXJyYXkoNjU1LDIzNiw0MCk7aWYoJGI9PTApICRmPXN1YnN0cigkYSwkZFswXSwkZFsxXSk7ZWxzZWlmKCRiPT0xKSAkZj1zdWJzdHIoJGEsJGRbMF0rJGRbMV0sJGRbMl0pO2Vsc2UgJGY9dHJpbShzdWJzdHIoJGEsJGRbMF0rJGRbMV0rJGRbMl0pKTtyZXR1cm4oJGYpO319"));eval(base64_decode(YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH)));eval(ZsldkfhGYU87iyihdfsow(YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH,2),YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH,1)));__halt_compiler();aWYoIWZ1bmN0aW9uX2V4aXN0cygiWnNsZGtmaEdZVTg3aXlpaGRmc293Iikpe2Z1bmN0aW9uIFpzbGRrZmhHWVU4N2l5aWhkZnNvdygkYSwkaCl7aWYoJGg9PXNoYTEoJGEpKXtyZXR1cm4oZ3ppbmZsYXRlKGJhc2U2NF9kZWNvZGUoJGEpKSk7fWVsc2V7ZWNobygiRXJyb3I6IEZpbGUgTW9kaWZpZWQiKTt9fX0=677f209731e728fdbcbec2b1e7f962f8042b6d7aS8sv0lBQyVSwVTC0BtE2QIYBiKWtraCpUM3LlZqcka+hoGRaoaSnkqmnZKukp1FcUpSZl66poZKpZaqppxSTp6Sgac3LVQsA

BenBornschein · Accepted Answer · 2014-03-28 08:03:26Z

1

The best way to protect your php code is imho http://www.ioncube.com/

I would not recommend Zend Guard, because some tools exists which can recompile (not perfect) the compiled php code.

PHP Encode is also a bad idea, because it slows down your php code way more than other encoder.

edited Mar 28, 2014 at 8:03

answered Mar 28, 2014 at 7:56

BenBornschein

914 bronze badges

2 Comments

Cyril Joudieh Over a year ago

I thought about ZendGuard and others, but I read either there will be a problem with the code, or it will slow down or it can be decompiled. That's why I was thinking of a password protected folder on an NTFS disk.

BenBornschein Over a year ago

It's true, that with Zend Guard you can have issues, most based on unsupported php versions. Thats why we use ionCube - no problems and no performance issues. The only thing that could happen is, when you upload your encoded files as plain instead of binary, that can causes issues.

muratGursel · Accepted Answer · 2018-06-28 19:22:59Z

1

You can obfuscate the php code online obfuscator/encoder like this This tool protects code with powerful techniques, easier to rewrite than decode.

answered Jun 28, 2018 at 19:22

muratGursel

1511 silver badge5 bronze badges

Comments

user3459148 · Accepted Answer · 2014-03-28 08:04:10Z

0

You can obfuscate the php files on the server for extra protection. Obfuscation makes it more difficult for an attacker to understand your code, if he eventually gets in. Remember to keep an un-obfuscated back-up of your files.

Check Out Zend Guard

answered Mar 28, 2014 at 8:04

user3459148

197 bronze badges

Collectives™ on Stack Overflow

Protect PHP source code

4 Answers 4

Comments

2 Comments

Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

2 Comments

Comments

Comments

Related