I'd like to ask how to protect my code that is running on a client server from being altered and/or copied.
It's running on Ubuntu Server with the standard Apache Php Mysql stack.
Any software needed would preferably be open-source.

I'd also like to terminate the application when there is a license problem.
Doing this using my code is possible but since it's php the client could alter the code to prevent this from happening.

  • 3
    client server?!
    – Songo
    Commented Jan 13, 2013 at 12:52
  • 1
    @Songo client as in "the guys paying me for the code", I presume.
    – user7043
    Commented Jan 13, 2013 at 12:52
  • 1
    Look for example here: programmers.stackexchange.com/questions/29496/… in general it's not fully possible but you might encode and obfuscate your source code. Commented Jan 13, 2013 at 13:02
  • It might not be obvious to you, but any code that runs on a client that you do not control can be altered, and there is absolutely no way of preventing this. You can make it slightly harder so that understanding and modifying it takes some dedication and effort, but that's about as good as it gets.
    – tdammers
    Commented Jan 13, 2013 at 19:24
  • Compile your code into binaries. Commented Jun 14, 2013 at 19:51

4 Answers 4


If you need to protect some magnificent algorithm you could have the code sitting on your own server with an authenticated API to access it, then distribute programs that use that API and sell credentials to use that API. It would then be possible to control code access as you pleased. This would be a sort of a software as a service type system that can be very effective in combating software piracy.

However this system has many potential flaws, one of which is it will be very difficult to persuade customers to trust this system knowing that if your company removes it's servers then they also lose theirs along with any investment of time/money into using the service.

Also the cost/maintenance would be substantial considering you would need to be able to support the combined traffic of all your customers received.

It would probably be easier to provide updates/support so people continue to pay for your services. I think it would be worth considering advice given on how to disable copying data from a webpage that any sort of protection that can easily be broken may not be worth the development effort and may annoy legitimate users and instead add value to continuing to pay for a licence.

  • As offering support and updates to the software with the license is already the plan. I think I'll have to settle for trusting the client.
    – HTDutchy
    Commented Jan 13, 2013 at 18:21
  • 1
    That wouldn't work anyway, since the client is open source so the code can be tampered with (i.e. they can change if ($response == $expected_result){ to if (true){ and they are done).
    – Jay
    Commented Jan 13, 2013 at 19:11
  • 1
    @Jay The client code would just be rendering code, it wouldn't include the actual functions being executed to generate the data.
    – Joel
    Commented Jan 13, 2013 at 19:32
  • In essence, you have: $code = fetch_code_via_api(); eval($code);. I raise you: $code = fetch_code_via_api(); file_put_contents('code1.txt', $code); eval($code); followed by changing the original code to eval(file_get_contents('code1.txt')); and the code is mine. At which point it'd probably be easier/cheaper to have bugs fixed internally than to pay you some fixed fee for usage of your API. If the code runs on the client, there is no way you can prevent it being taken. As I said in my answer, IonCube isn't perfect either, but it's close.
    – Jay
    Commented Jan 13, 2013 at 19:57
  • 1
    @Jay When PHP runs your browser isn't sent the PHP to execute it's sent the HTML produced by the PHP. In this case there is the 'client' who acts as a proxy between the end-user and the central server who is only sent the rendering of that data not the method used to produce the data. Dropbox for example expose their API that doesn't mean anyone can just reconstruct the Dropbox code.
    – Joel
    Commented Jan 13, 2013 at 22:34

Any software needed would preferably be open-source.

To the best of my knowledge, you're out of luck on this one. Making PHP 'encryption' is a business, and open sources solutions just won't/don't cut it as well (from the ones I found, it took me under 10 minutes to defeat them because all they really did was base64_encode the code, rotate it a few times, then eval the reversed process in order to execute the code. Replacing eval with echo made it trivial to defeat. The best one I saw used magic variables like __LINE__ in order to prevent this kind of thing, but was still pretty easily defeatable for any experienced PHP dev once you noticed this.).

IonCube is still pretty hard to defeat, you have to pay someone upwards of $5 - $8 per file to decrypt it. If you have a lot of files: this is a financial barrier. They also have licensing options so you can prevent the code being copy/pasted onto other servers and just run as-is.

  • It seems like there is a need for an open source project there...
    – HTDutchy
    Commented Jan 13, 2013 at 18:22
  • 8
    @s4uadmin You're unlikely to find developers both interested in open source or free software, also willing to work on a project that actively closes source code via obfuscation or encryption.
    – Michael
    Commented Jan 13, 2013 at 19:00
  • Why not simply compile the code ? Commented Jun 14, 2013 at 19:55

You have two options:-

  1. Learn to trust your clients.
  2. re-Factor your software in a compiled language (Java, C# will do but they can be reverse engineered with comparative ease, C,C++ are pretty much impossible to reverse engineer but are not very good for WEB applications).

You should also realize that any reasonably competent programmer could probably reproduce your system only by observing its behavior without ever looking at your code.


Take a look at this new opensource project:


BLENC is an extension that permit to protect PHP source scripts with Blowfish Encription. BLENC hooks into the Zend Engine, allowing for transparent execution of PHP scripts previously encoded with BLENC. It is not designed for complete security (it is still possible to disassemble the script into op codes using a package such as XDebug), however it does keep people out of your code and make reverse engineering difficult.

  • have u ever used blenc, to me sames the only solution, i need tho know how could i compile it Commented Sep 23, 2013 at 11:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.