An effective way to protect PHP code without encryption

Question

First of all, I'm not looking for miracles... I know how PHP works, and there's no real way to hide my code from the client without using encryption. But this comes with the cost of installing the extension on the running server.

I'm looking for something different... I don't want to encrypt my code or even obfuscate it. There are many PHP scripts that don't have encrypted/obfuscated code, but they are commercial applications. For example, vBulletin and/or IP.Board forum applications.

I just wonder what methods these people use in their applications...

I'm also open to any other suggestions.

Please note that I am single and do not work for a company. My product is also very specific and I can’t sell that much. I just want you to know that I cannot afford to consult a legal professional to sue someone or prepare a business license. I'm just looking for a simple way to protect my simple product, if indeed it's possible, somehow...

Answer 1

You need to consider your goals:

1) Are you trying to prevent people from reading/modifying your code? If so, you will need an obfuscation/encryption tool. I use Zend Guard with good success.

2) Are you trying to prevent unauthorized redistribution of code? The EULA/exclusive license will give you the legal power to prevent this from happening, but it won't actually prevent it. The key/activation scheme will allow you to proactively monitor usage, but can be removed unless you also encrypt your code. Zend Guard also has the ability to lock specific scripts to specific client computers and/or create time-limited versions of your code if you want to do that.

I'm not familiar with things like vBulletin, but they either need to encrypt/obfuscate or trust their users to do the right thing. In the latter case, they are protected by a EULA that prohibits behavior they deem to be bad, and there is a legal system that supports violations of the EULA.

If you're not prepared/unable to take legal action to protect your software, and you don't want encryption/obfuscation, your options are a) Release it via EULA so you have legal options if you ever need it and Hope for the best, or b) consider whether an open source license would be more appropriate and only allow redistribution.

Answer 2

Mixing things up will only inconvenience your legitimate, law-abiding customers, and those who would rip you off are not your target paying customers anyway. (Additional thoughts on obfuscation removed)

Another tip for protecting your software: Create a business model where code is an incomplete part of your product's value. For example, selling product licenses and access to certain data that you manage on the website, or licensing products through a subscription model or through customer support.

Designing a EULA is a legal issue, not a coding issue. You can start by reading some EULA text for the products and websites you use. You might find some interesting details!

Creating a proprietary license is very flexible, and may be beyond the scope of StackOverflow's expectations, as it's not strictly about coding.

Some parts of the EULA that come to mind:

• Limit your liability if the product contains an error or causes damage.
• Details how customers use their licensed software, for how long, on how many machines, with or without redistribution rights, etc.
• Grants you the right to audit their website so that you can enforce the license.
• What happens if they violate the EULA, such as losing their privileges to use your software.

You should consult a legal professional to prepare a commercial EULA.

Editor: If the project does not justify attorney's fees, please review the following resources:

• About joelonsoftware's "EULA Suggestion"
• "How to write an End User License Agreement"