Actually I'm dealing with a trouble in my system, I have to delivery the system to clients and it was built in PHP, JS, ShellScript and SQL.

I would like to encrypt the code or obfuscate it from eyes of others! Then someone from the community told me about building my own PHP extension, it sounds to me as a great idea, since it will not be with the main code of the system.

But I have a problem doing this way, if a programmer get in the extensions and find it, all the hard work has gone. Then I'm here to ask again about this matter.

What is the best way to hide my Business Logic from third parties?

I know that there are stuff like IonCube, Zend Guard, and many others. But I'm looking something that I can build myself.

Is PHP extension the right way to follow? Or some Half SaaS system, with dependencies (Business Logic) in a remote server?

About the environment

OS: Kernel Linux - LAMPP (Apache 2.2, MySQL 5.5 PHP 5.3.8)

In php generally the extension is located at /php/ext/ but in lampp I have no idea where it is, I just found a folder /opt/lampp/lib/php/extensions/ is that right place?


What you are trying to do is commonly known as security through obscurity, and it's generally not a good idea. You can transform parts of your PHP code to PHP extensions* if you want, but your primary motivation should be efficiency not security, as every compiled piece of code can get reversed engineered with a decompiler. As Claude Shannon put it best: The enemy knows the system.

But if you really want to go through with this, one of the most efficient ways to do it is Facebook's HipHop:

HipHop transforms your PHP source code into highly optimized C++ and then compiles it with g++ to build binary files. You keep coding in simpler PHP, then HipHop executes your source code in a semantically equivalent manner and sacrifices some rarely used features – such as eval() – in exchange for improved performance.

Zend Guard is indeed marketed as a tool to protect your code from privy eyes:

Zend Guard (formerly Zend Encoder) protects your applications from reverse engineering and unauthorized customization by providing encoding and obfuscation. It further protects from unlicensed use and redistribution by providing comprehensive licensing support. This combined functionality makes software distribution worry free.

but that's just sales speak, Zend Guard encoding is easily broken as is IonCube's.

Granted, if you rewrite your code as extensions, or transform and compile it with HipHop, or encode and obfuscate it with Zend Guard, you are adding an extra layer of security, a very thin layer, that will probably discourage novice developers. If you really want to protect your intellectual property, you should approach this legally: Consult a lawyer and sign a contract with your clients before submitting the code.

You could of course have some of the dependencies on saas mode, provided that this won't affect the performance and efficiency of your final product. If you're doing it just for security, your doing it wrong.

* Writing extensions is quite a complex thing to do, and there's less than little documentation for it out there. A good place to start is Extension Writing Part I: Introduction to PHP and Zend, in Zend's DevZone. Just a hint: You'll need to be fluent in C and familiar with PHP's source code.

  • I think I achieve what I was looking for, with a lot of useful information that you has provided here. I just need to use the Business Logic in a separate place, I'm looking to use it in a Remote Server and provide this piece of code as a SaaS Module. HipHop is not the kind of stuff that I'm looking at this moment, anyway thanks for the reference, for sure HipHop will be useful in future projects. Finally PHP extension for this purpose I'm convinced that is not the way to follow. Thanks for your response. I will accept it as the answer, it fits to me. One more time thanks. – deepcell Nov 25 '11 at 18:13
  • PHP Extension, I'm following this paper -> devzone.zend.com/303/… It is a great reference. By the way it was the same resource that @Yannis Rizos provided. – deepcell Nov 25 '11 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.