What do I need to develop a PHP extension in lampp?

Question

Actually I'm dealing with a trouble in my system, I have to delivery the system to clients and it was built in PHP, JS, ShellScript and SQL.

I would like to encrypt the code or obfuscate it from eyes of others! Then someone from the community told me about building my own PHP extension, it sounds to me as a great idea, since it will not be with the main code of the system.

But I have a problem doing this way, if a programmer get in the extensions and find it, all the hard work has gone. Then I'm here to ask again about this matter.

What is the best way to hide my Business Logic from third parties?

I know that there are stuff like IonCube, Zend Guard, and many others. But I'm looking something that I can build myself.

Is PHP extension the right way to follow? Or some Half SaaS system, with dependencies (Business Logic) in a remote server?

About the environment

OS: Kernel Linux 2.6.37.1-1.2 - LAMPP (Apache 2.2, MySQL 5.5 PHP 5.3.8)

In php generally the extension is located at /php/ext/ but in lampp I have no idea where it is, I just found a folder /opt/lampp/lib/php/extensions/ is that right place?

Answer 1

What you are trying to do is commonly known as security through obscurity, and it's generally not a good idea. You can transform parts of your PHP code to PHP extensions^* if you want, but your primary motivation should be efficiency not security, as every compiled piece of code can get reversed engineered with a decompiler. As Claude Shannon put it best: The enemy knows the system.

But if you really want to go through with this, one of the most efficient ways to do it is Facebook's HipHop:

HipHop transforms your PHP source code into highly optimized C++ and then compiles it with g++ to build binary files. You keep coding in simpler PHP, then HipHop executes your source code in a semantically equivalent manner and sacrifices some rarely used features – such as eval() – in exchange for improved performance.

Zend Guard is indeed marketed as a tool to protect your code from privy eyes:

Zend Guard (formerly Zend Encoder) protects your applications from reverse engineering and unauthorized customization by providing encoding and obfuscation. It further protects from unlicensed use and redistribution by providing comprehensive licensing support. This combined functionality makes software distribution worry free.

but that's just sales speak, Zend Guard encoding is easily broken as is IonCube's.

Granted, if you rewrite your code as extensions, or transform and compile it with HipHop, or encode and obfuscate it with Zend Guard, you are adding an extra layer of security, a very thin layer, that will probably discourage novice developers. If you really want to protect your intellectual property, you should approach this legally: Consult a lawyer and sign a contract with your clients before submitting the code.

You could of course have some of the dependencies on saas mode, provided that this won't affect the performance and efficiency of your final product. If you're doing it just for security, your doing it wrong.

_{* Writing extensions is quite a complex thing to do, and there's less than little documentation for it out there. A good place to start is Extension Writing Part I: Introduction to PHP and Zend, in Zend's DevZone. Just a hint: You'll need to be fluent in C and familiar with PHP's source code.}