Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to ask how to protect my code that is running on a client server from being altered and/or copied.
It's running on Ubuntu Server with the standard Apache Php Mysql stack.
Any software needed would preferably be open-source.

I'd also like to terminate the application when there is a license problem.
Doing this using my code is possible but since it's php the client could alter the code to prevent this from happening.

Thanks in advance.

share|improve this question
client server?! – Songo Jan 13 '13 at 12:52
@Songo client as in "the guys paying me for the code", I presume. – delnan Jan 13 '13 at 12:52
Look for example here:… in general it's not fully possible but you might encode and obfuscate your source code. – Luc Franken Jan 13 '13 at 13:02
It might not be obvious to you, but any code that runs on a client that you do not control can be altered, and there is absolutely no way of preventing this. You can make it slightly harder so that understanding and modifying it takes some dedication and effort, but that's about as good as it gets. – tdammers Jan 13 '13 at 19:24
Compile your code into binaries. – user61852 Jun 14 '13 at 19:51
up vote 2 down vote accepted

If you need to protect some magnificent algorithm you could have the code sitting on your own server with an authenticated API to access it, then distribute programs that use that API and sell credentials to use that API. It would then be possible to control code access as you pleased. This would be a sort of a software as a service type system that can be very effective in combating software piracy.

However this system has many potential flaws, one of which is it will be very difficult to persuade customers to trust this system knowing that if your company removes it's servers then they also lose theirs along with any investment of time/money into using the service.

Also the cost/maintenance would be substantial considering you would need to be able to support the combined traffic of all your customers received.

It would probably be easier to provide updates/support so people continue to pay for your services. I think it would be worth considering advice given on how to disable copying data from a webpage that any sort of protection that can easily be broken may not be worth the development effort and may annoy legitimate users and instead add value to continuing to pay for a licence.

share|improve this answer
As offering support and updates to the software with the license is already the plan. I think I'll have to settle for trusting the client. – HTDutchy Jan 13 '13 at 18:21
That wouldn't work anyway, since the client is open source so the code can be tampered with (i.e. they can change if ($response == $expected_result){ to if (true){ and they are done). – Jay Jan 13 '13 at 19:11
@Jay The client code would just be rendering code, it wouldn't include the actual functions being executed to generate the data. – Joel Jan 13 '13 at 19:32
In essence, you have: $code = fetch_code_via_api(); eval($code);. I raise you: $code = fetch_code_via_api(); file_put_contents('code1.txt', $code); eval($code); followed by changing the original code to eval(file_get_contents('code1.txt')); and the code is mine. At which point it'd probably be easier/cheaper to have bugs fixed internally than to pay you some fixed fee for usage of your API. If the code runs on the client, there is no way you can prevent it being taken. As I said in my answer, IonCube isn't perfect either, but it's close. – Jay Jan 13 '13 at 19:57
@Jay When PHP runs your browser isn't sent the PHP to execute it's sent the HTML produced by the PHP. In this case there is the 'client' who acts as a proxy between the end-user and the central server who is only sent the rendering of that data not the method used to produce the data. Dropbox for example expose their API that doesn't mean anyone can just reconstruct the Dropbox code. – Joel Jan 13 '13 at 22:34

Any software needed would preferably be open-source.

To the best of my knowledge, you're out of luck on this one. Making PHP 'encryption' is a business, and open sources solutions just won't/don't cut it as well (from the ones I found, it took me under 10 minutes to defeat them because all they really did was base64_encode the code, rotate it a few times, then eval the reversed process in order to execute the code. Replacing eval with echo made it trivial to defeat. The best one I saw used magic variables like __LINE__ in order to prevent this kind of thing, but was still pretty easily defeatable for any experienced PHP dev once you noticed this.).

IonCube is still pretty hard to defeat, you have to pay someone upwards of $5 - $8 per file to decrypt it. If you have a lot of files: this is a financial barrier. They also have licensing options so you can prevent the code being copy/pasted onto other servers and just run as-is.

share|improve this answer
It seems like there is a need for an open source project there... – HTDutchy Jan 13 '13 at 18:22
@s4uadmin You're unlikely to find developers both interested in open source or free software, also willing to work on a project that actively closes source code via obfuscation or encryption. – Michael Jan 13 '13 at 19:00
Why not simply compile the code ? – user61852 Jun 14 '13 at 19:55

You have two options:-

  1. Learn to trust your clients.
  2. re-Factor your software in a compiled language (Java, C# will do but they can be reverse engineered with comparative ease, C,C++ are pretty much impossible to reverse engineer but are not very good for WEB applications).

You should also realize that any reasonably competent programmer could probably reproduce your system only by observing its behavior without ever looking at your code.

share|improve this answer

Take a look at this new opensource project:

BLENC is an extension that permit to protect PHP source scripts with Blowfish Encription. BLENC hooks into the Zend Engine, allowing for transparent execution of PHP scripts previously encoded with BLENC. It is not designed for complete security (it is still possible to disassemble the script into op codes using a package such as XDebug), however it does keep people out of your code and make reverse engineering difficult.

share|improve this answer
have u ever used blenc, to me sames the only solution, i need tho know how could i compile it – Ehsan Ershadi Sep 23 '13 at 11:14

protected by GlenH7 Dec 20 '14 at 21:53

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.