Re: protecting your php code from other peeping toms?

How many of your users are going to exploit your code? What is the worst thing that would happen? some people would buy your code and then set up a site www.come-get-mikes-great-code-for-free.com? Then you become a well known programmer, and you make money consulting! How does MySQL afford to develop such an outstanding product and just "give" it away, source and all? How about PHP developers. Besides, I am sure that many competent php developers would be able to take the functionality of your classes - without looking at the source - and create ones that work just as well - if not better. If you want to hide your source from your clients, then go write your own language, and go from there. When I was in college, I wanted to cut out some gears from plexiglass in the engineering lab. I was using AutoCAD 2000 for drawing them and an Epilog Laser Engraver for the cutting. I went out of the web and found some AutoLISP scripts for drawing exact gears. They were written for the previous version of AutoCAD. They did not work (i am sure it was a minor version issue). I am sure it was a simple error, but NO, they had to go and encrypt the source code of a free script???? So I got screwed over. BTW, I ended up drawing my own gears, but WHAT A PAIN. All I ask is you consider the hard work that all the open source developers put in for you, before you use their products to do what you are talking about. Best Regards, -Jason Garber IonZoft.com At 08:25 PM 10/10/2001 -0400, newsgrp@OneGeek.com wrote:

Hi, First time posting. Did a quick search of the last 300 messages and couldn't find any help. If there are any FAQs for this newsgroup, I could take that and check those out. My question... I want to create some great php code and install it on web sites for my clients. Now, this code is my property and I'd like to keep it that way. What are my options for securing this code from other eyes? I will go into this deeper... If I have php code sitting in someone's home directory(btw, I am using linux), they can ftp to get it. Okay, So block FTP, telnet/ssh for that user. Now -- how else could that user get a hold of my code? They could exploit an insecure php script and do a simple 'move *.php *.txt' and simply retrieve the *.txt via http. However, this would probably be unlikely and for the most paranoid. What if even I had to keep FTP running? I could move the top secret PHP scripts outside of a directory that the user didn't have FTP access to. However, the user could run his php script from http to do a simple copy ../../*.php to *.txt. So right now the problem seems to be that PHP code is hard to protect because it is in plain text. There is a solution to that -- zend optimizer. I looked into that a bit. Unfortunately it does not fit into the open source category and is quite expensive (US$2,400.00 -- or maybe I misunderstood and it is only 24.00 =). So that seems to be out of the option for most people. Let's step away from the interpreted languages and move to compiled code. What are the options for creating compiled code and having that interact with my PHP scripts that I don't mind others seeing. My compiled code would be 'some great php[well not php] code' as shown in paragraph two. Compiled code would be harder for someone to get at with ease. It is good enough for me to work with. Of course for the most paranoid there are ways to decompile code, but thats for the more paranoid =]. Basically, I have a bunch of classes I want to secure. PHP is plain text, a nd that seems to be the insecure part about it. My original question was going to be on how to get compiled code returning data to calls made from PHP. For example: returning an array that PHP could understand from a c program to a PHP script and then to the browser. Hopefully, all the questinos I brought up and scenerios that were described will pop some ideas in coder's heads. How do you guys protect code -- if you do. What are other options that I missed. Thank you, Mike Hostetter -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net For additional commands, e-mail: php-general-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net