This topic is locked

Protection script created with PHPR

7/8/2012 10:22:49 AM
PHPRunner General questions
M
maxcolo author

Hi,

if I wanted to sell a script created with PHPR how could I avoid that a client can pass it to another for free?In practice how to protect it to make a single copy only usable by those who had purchased?

Thanks for any suggestions

E
electromotive 7/8/2012



Hi,

if I wanted to sell a script created with PHPR how could I avoid that a client can pass it to another for free?In practice how to protect it to make a single copy only usable by those who had purchased?

Thanks for any suggestions



If you are not hosting the application yourself [or managing the web server], then in short you can't.
This is not a particular issue assoicated with PHPR, it concerns virtually all internet based software. If you are licensing the same code to multiple clients, then you can insert an obfusicated license code into the software to create an ability to detect where illegal & unlicensed copies came from - a digital watermark. If you find any then you have to decide what recourse you have. Copies can be stolen without any knowledge of the licensee; its going to be difficult to insist that a licensee lock down their hosts to such an extent that copies can't be stolen by other host users or by data center staff - very hard to prove how a copy was taken and who was responsible.
I suggest you look at other licensing models, like making the code open-source and find another way of recovering your costs. I suggest you start reading about the open-source business models and how companies generate revenue. This issue is the real reason why open-source paradigm exists and is so popular.
https://en.wikipedia.org/wiki/Open_source

https://en.wikipedia.org/wiki/Open-source_software
The alternative is to try a build-in a protection system. But PHP code is not installed, it consists of hundreds or thousands of readable modules each of which runs independently on top of any number of webservers, most of which are open-source. The problem is that even with obfusication, such protection schemes or bugs are detectable and can be bypassed by clever hacker. To be effective you'd have to supply a whole webserver with the application built-in, and that webserver would need to be installed and bound to the server. Big companies can do this.
Google and eBay and every other internet service provider protects their code by operating their own hosts. You can't download the google search engine. How does google generate its revenue? It sells advertising. They all sell advertising or support services. They don't sell software.
PHPR itself uses a licensing model, this only works because all the software runs on a PC, and has an installer to tie the installed code to a particular machine. You can't do this with PHP. PHP itself and most of the server OS's it runs on are open-source, which makes their deployment extremely easy and flexible, supported on a vaste array of hosts. You can't have it both ways unfortunately.

Sergey Kornilov admin 7/9/2012

Theoretically it's possible to protect PHP scripts so they can only run on specific web host. This will require a few extra steps for you and for your customers.

  1. You need to encrypt your PHP code using ionCube or Zend encoder.
  2. You need to add additional code that will connect to your own web server, validate if license is correct and that domain name matches the one on file. This will prevent client from using your code on more than one server. If client needs to move script to another web server they need to logon to your website and change the authorized domain name.
    In other words you need to roll out your own license solution which may not worth the effort.

C
cgphp 7/9/2012



2. You need to add additional code that will connect to your own web server, validate if license is correct and that domain name matches the one on file. This will prevent client from using your code on more than one server. If client needs to move script to another web server they need to logon to your website and change the authorized domain name.
In other words you need to roll out your own license solution which may not worth the effort.


The Pro and Cerberus version of ioncube, offer this kind of protecion: http://www.ioncube.com/sa_encoder.php?page=pricing