note 89543 added to function.eval

I updated my code because there are many abuses of the function eval() in phpscripts to break security, privacy, to perform callbacks, to execute commands on the server by remote. This could not be allowed in a professional environment which often deals with sensitive, important or financial data. Code obfuscation is not a safe solution to protect Your source at all. As I do disagree with some programmers to use any ( ! ) solution to encrypt php code. I advocate to not scramble code and to not implement call home events (which hit the firewall or reverse proxy anyway). Call backs do violate privacy of the user. It can be considered as spyware, theft of information. All serverside code should be readable to to verify if no sensitive information is transfered to the vendor or to verify it is not malware. Running scrambled code is as dangerous as to run a server without any security measures. That's why some hosting providers refuse to run scrambled code on their servers. As programmer, the best way You can do is to create many revisions of Your code, as to provide additional plugins, services and support for registered users. So do not encrypt a single line of code at all, do follow the opensource standard and do respect privacy and the right of verification of the user of your scripts. So here is an updated version, to use with PHP-CLI If it fails in the process, You can invoke with the verbose option so You can follow the process and alter this code. ----- snippet denest.php.sh ----------- #!/usr/bin/php <?php // FILE: denest.php.sh // perform chmod +x denest.php.sh echo "\nDECODE nested eval(gzinflate()) by DEBO Jurgen <webmaster@purechocolates.com>\n\n"; /* invokation php-cli: #php denest.php <your_nested_script.php> <verbose empty,0=OFF 1=ON> */ $filename_full = $argv[1]; $verbose = (bool) $argv[2]; $filename_base = basename ($filename_full,'.php'); $content = ""; echo "Using: ".$filename_base.".php\n"; echo "Read...\n"; $fp1 = fopen ($filename_full, "r"); $content = fread ($fp1, filesize ($filename_full)); fclose($fp1); echo "Decode...\n"; while ( is_nested($content) ) $content=denest($content); dump($content,TRUE); function is_nested ($text) { return preg_match("/eval\(gzinflate/",$text); } function denest ($text) { global $verbose; $text=preg_replace("/<\?php|<\?|\?>/", "", $text); if ($verbose) dump ($text,FALSE); eval(preg_replace("/eval/", "\$text=", $text)); if ($verbose) dump ($text,FALSE); return $text; } function dump ($text,$final) { static $counter = 0 ; global $filename_base; $filename_new = ($final) ? ($filename_base.".done.php") : ($filename_base.".".sprintf("%04d", ++$counter).".php"); echo "Writing ".$filename_new."\n"; $fp2 = fopen($filename_new,"w"); fwrite($fp2, trim($text)); fclose($fp2); } ?> ----- snippet denest.php.sh ----------- ---- Server IP: 193.190.67.11 Probable Submitter: 83.134.143.121 ---- Manual Page -- http://www.php.net/manual/en/function.eval.php Edit -- https://master.php.net/note/edit/89543 Del: integrated -- https://master.php.net/note/delete/89543/integrated Del: useless -- https://master.php.net/note/delete/89543/useless Del: bad code -- https://master.php.net/note/delete/89543/bad+code Del: spam -- https://master.php.net/note/delete/89543/spam Del: non-english -- https://master.php.net/note/delete/89543/non-english Del: in docs -- https://master.php.net/note/delete/89543/in+docs Del: other reasons-- https://master.php.net/note/delete/89543 Reject -- https://master.php.net/note/reject/89543 Search -- https://master.php.net/manage/user-notes.php