无需加密即可保护 PHP 代码的最佳解决方案

Best solution to protect PHP code without encryption

提问by rfgamaral

First of all, I'm not looking for miracle... I know how PHP works and that there's not really way to hide my code from the clients without using encryption. But that comes with the cost of an extension to be installed on the running server.

首先，我不是在寻找奇迹……我知道 PHP 是如何工作的，并且没有真正的方法可以在不使用加密的情况下向客户端隐藏我的代码。但这伴随着在运行的服务器上安装扩展的成本。

I'm looking for something different though... I'm not looking to encrypt my code or even obfuscate it. There are many PHP scripts without encrypted/obfuscated code but they are commercial applications. For instance, vBulletin and/or IP.Board forum applications.

不过，我正在寻找不同的东西......我不想加密我的代码，甚至混淆它。有许多没有加密/混淆代码的 PHP 脚本，但它们是商业应用程序。例如，vBulletin 和/或 IP.Board 论坛应用程序。

I just want to know what approach do these guys use for their applications...

我只想知道这些人在他们的应用程序中使用什么方法......

I'm also open to any other suggestions.

我也愿意接受任何其他建议。

Please note that I'm a single person and not working for a company. My product is also very specific, it won't sell that much. I just want you guys to know that I can't afford to consult a legal professional either to sue someone or prepare a commercial license. I'm just looking for a simple way to protect my simple product, if it's indeed possible, somehow...

请注意，我是一个人，不为公司工作。我的产品也很具体，卖不了那么多。我只是想让你们知道，我负担不起咨询法律专业人士以起诉某人或准备商业许可证的费用。我只是在寻找一种简单的方法来保护我的简单产品，如果确实可能的话，不知何故......

采纳答案by Bill Karwin

Obfuscating things can only inconvenience your legitimate, law-abiding customers, while the people who would would rip you off are not your target paying customers anyway. (edited out other thoughts about obfuscation)

混淆视听只会给你合法、守法的客户带来不便，而那些会欺骗你的人无论如何都不是你的目标付费客户。（编辑掉其他关于混淆的想法）

Another suggestion for protecting your software: create a business model in which the code is an incomplete part of the value of your offering. For example, sell product licenses along with access to some data you manage on your site, or license the product on a subscription model or with customer support.

保护您的软件的另一个建议：创建一个商业模型，其中代码是您产品价值的不完整部分。例如，出售产品许可以及访问您在网站上管理的某些数据，或者以订阅模式或通过客户支持许可产品。

Designing a EULA is a legal matter, not a coding matter. You can start by reading some EULA text for products and websites you use. You might find some interesting details!

设计 EULA 是一个法律问题，而不是编码问题。您可以先阅读一些有关您使用的产品和网站的 EULA 文本。你可能会发现一些有趣的细节！

Creating a proprietary license is is highly flexible, and probably a subject beyond the intended scope of StackOverflow, since it's not strictly about coding.

创建专有许可证是非常灵活的，并且可能超出了 StackOverflow 的预期范围，因为它与编码无关。

Some parts of a EULA that come to mind:

想到的 EULA 的某些部分：

• Limiting your liability if the product has bugs or causes damage.
• Spelling out how the customer can use their licensed software, for how long, on how many machines, with or without redistribution rights, etc.
• Giving you rights to audit their site, so you can enforce the licenses.
• What happens if they violate the EULA, e.g. they lose their privilege to use your software.

• 如果产品存在错误或造成损坏，则限制您的责任。
• 说明客户如何使用他们的许可软件、使用多长时间、在多少台机器上、有或没有再分发权等。
• 授予您审核其站点的权利，以便您可以强制执行许可证。
• 如果他们违反 EULA，会发生什么情况，例如他们失去使用您的软件的特权。

You should consult a legal professional to prepare a commercial EULA.

您应该咨询法律专业人士以准备商业 EULA。

edit:If this project can't justify the expense of a lawyer, check out these resources:

编辑：如果这个项目不能证明律师的费用是合理的，请查看以下资源：

• "EULA advice" on joelonsoftware
• "How to Write an End User License Agreement"

• 关于 joelon 软件的“ EULA 建议”
• “如何编写最终用户许可协议”

回答by Jim OHalloran

You need to consider your objectives:

你需要考虑你的目标：

1) Are you trying to prevent people from reading/modifying your code?If yes, you'll need an obfuscation/encryption tool. I've used Zend Guardwith good success.

1）您是否试图阻止人们阅读/修改您的代码？如果是，您将需要一个混淆/加密工具。我已经成功使用Zend Guard。

2) Are you trying to prevent unauthorized redistribution of your code??A EULA/proprietary license will give you the legal power to prevent that, but won't actually stop it. An key/activation scheme will allow you to actively monitor usage, but can be removed unless you also encrypt your code. Zend Guard also has capabilities to lock a particular script to a particular customer machine and/or create time limited versions of the code if that's what you want to do.

2）您是否试图防止未经授权的重新分发您的代码？EULA/专有许可证将赋予您阻止这种情况的法律权力，但实际上并不会阻止它。密钥/激活方案将允许您主动监控使用情况，但除非您还加密了代码，否则可以将其删除。Zend Guard 还具有将特定脚本锁定到特定客户机器和/或创建代码的时间限制版本（如果这是您想要做的）的功能。

I'm not familiar with vBulletin and the like, but they'd either need to encrypt/obfuscate or trust their users to do the right thing. In the latter case they have the protection of having a EULA which prohibits the behaviors they find undesirable, and the legal system to back up breaches of the EULA.

我不熟悉 vBulletin 等，但他们要么需要加密/混淆，要么相信他们的用户会做正确的事情。在后一种情况下，他们受到拥有 EULA 的保护，该 EULA 禁止他们认为不受欢迎的行为，以及支持违反 EULA 的法律体系。

If you're not prepared/able to take legal action to protect your software and you don't want to encrypt/obfuscate, your options are a) Release it with a EULA so you're have a legal option if you ever need it and hope for the best, or b) consider whether an open source license might be more appropriate and just allow redistribution.

如果您不准备/无法采取法律行动来保护您的软件，并且您不想加密/混淆，您的选择是 a) 使用 EULA 发布它，以便您在需要时有一个合法的选择并希望最好，或者 b) 考虑开源许可证是否更合适并只允许重新分发。

回答by grepsedawk

You could use a php compiler:

您可以使用 php 编译器：

Roadsend

路送

phc

医生

回答by Alarion

I have not looked at the VBulletin source code in some time, but the way they used to do it around 2003 was to embed a call to their server inside the code. IIRC, it was on a really long code line (like 200-300+ chars long) and was broken up over several string concatenations and such.

我有一段时间没有查看 VBulletin 源代码，但他们在 2003 年左右使用的方法是在代码中嵌入对服务器的调用。IIRC，它在一个非常长的代码行上（比如 200-300+ 个字符长）并且被几个字符串连接等分解。

It did nothing "bad" if you pirated it - the forum still worked 100%. But your server's IP was logged along with other info and they used that to investigate and take legal action.

如果你盗版，它没有什么“坏事” - 论坛仍然 100% 工作。但是你的服务器的 IP 与其他信息一起被记录下来，他们用它来调查和采取法律行动。

Your license number was embedded in this call, so they could easily track how many IPs/websites a given licensed copy was running on.

您的许可证号已嵌入此调用中，因此他们可以轻松跟踪给定的许可副本正在运行的 IP/网站数量。

回答by Alarion

If you can't create a "cloud app" that you host yourself and they access via the Web, then you could look into creating a virtual appliance using a virtual server (from VMWare, Parallels, Sun, etc) and install a "lite" version of Linux on that. Put your PHP code in the virtual environment and install the virtual machine on their server. Make sure to create a way to prevent loading into root. Of course, this would involve physically visiting the client yourself.

如果您无法创建自己托管并通过 Web 访问的“云应用程序”，那么您可以考虑使用虚拟服务器（来自 VMWare、Parallels、Sun 等）创建虚拟设备并安装“精简版” " 那个版本的 Linux。将您的 PHP 代码放在虚拟环境中并在他们的服务器上安装虚拟机。确保创建一种防止加载到 root 的方法。当然，这将涉及亲自拜访客户。

回答by Eran Galperin

They distribute their software under a proprietary license. The law protects their rights and prevents their customers from redistributing the source, though there is no actual difficulty doing so.

他们根据专有许可分发他们的软件。法律保护他们的权利并阻止他们的客户重新分发源，尽管这样做没有实际困难。

But as you might be well aware, copyright infringement (piracy) of software products is a pretty common phenomenon.

但您可能很清楚，软件产品的版权侵权（盗版）是一种非常普遍的现象。

回答by achy

in my opinion is, but just in case if your php code program is written for standalone model... best solutions is c) You could wrap the php in a container like Phalanger (.NET). as everyone knows it's bind tightly to the system especially if your program is intended for windows users. you just can make your own protection algorithm in windows programming language like .NET/VB/C# or whatever you know in .NET prog.lang.family sets.

在我看来是，但以防万一，如果您的 php 代码程序是为独立模型编写的……最好的解决方案是 c) 您可以将 php 包装在像 Phalanger (.NET) 这样的容器中。众所周知，它与系统紧密结合，特别是如果您的程序是为 Windows 用户设计的。您可以使用 Windows 编程语言（如 .NET/VB/C# 或您在 .NET prog.lang.family 中知道的任何内容）制作自己的保护算法。

回答by Igdrazil

Zend Guard does not support php 5.5 and is easy to reverse, go for http://www.ioncube.comfor obfuscation. http://wwww.phplicengine.comcan license the scripts remotely or locally.

Zend Guard 不支持 php 5.5 并且很容易逆向，去http://www.ioncube.com进行混淆。http://www.phplicengine.com可以远程或本地许可脚本。

回答by Ira Baxter

See our SD PHP Obfuscator. Handles huge systems of PHP files. No runtime requirements on PHP server. No extra runtime overhead.

请参阅我们的SD PHP 混淆器。处理庞大的 PHP 文件系统。PHP 服务器上没有运行时要求。没有额外的运行时开销。

[EDIT May 2016] A recent answer noted that Zend does not handle PHP5.5. The SD PHP Obfuscator does.

[编辑 2016 年 5 月] 最近的回答指出 Zend 不处理 PHP5.5。SD PHP 混淆器可以。

回答by qualbeen

The only way to really protect your php-applications from other, is to not share the source code. If you post you code somewhere online, or send it to you customers by some medium, other people than you have access to the code.

真正保护您的 php 应用程序免受其他人侵害的唯一方法是不共享源代码。如果您将代码张贴在网上的某个地方，或通过某种媒介将其发送给您的客户，那么除了您之外的其他人都可以访问该代码。

You could add an unique watermark to every single copy of your code. That way you can trace leaks back to a singe customer. (But will that help you, since the code already are outside of your control?)

您可以为代码的每个副本添加唯一的水印。这样您就可以将泄漏追溯到单个客户。（但这对您有帮助吗，因为代码已经超出了您的控制范围？）

Most code I see comes with a licence and maybe a warranty. A line at the top of the script telling people not to alter the script, will maybe be enought. Self; when I find non-open source code, I won't use it in my projects. Maybe I'm a bit dupe, but I expect ppl not to use my none-OSS code!

我看到的大多数代码都带有许可证，也许还有保修。脚本顶部的一行告诉人们不要更改脚本，也许就够了。自己; 当我发现非开源代码时，我不会在我的项目中使用它。也许我有点受骗，但我希望人们不要使用我的非 OSS 代码！