php 部署时如何保护我的源代码？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/9826672/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How to protect my source code when deployed?
提问by coderama
Is there a way to encrypt or enclose my code on my Linux server after deployment? I know Zend does some kind of encryption, right? Is that what people use? Is this even possible? How do I go about keeping my code secure online?
有没有办法在部署后加密或封装我的 Linux 服务器上的代码？我知道 Zend 会进行某种加密，对吗？那是人们使用的吗？这甚至可能吗？我如何确保我的代码在线安全？
回答by 472084
You are right, you can use Zend Encoder, Ion Cubeor something like Source Guardianto encrypt your source code.
你是对的，你可以使用Zend Encoder、Ion Cube或Source Guardian 之类的东西来加密你的源代码。
Its not really needed unless you are giving away your code and dont want people to steal it though.
它不是真的需要，除非你放弃你的代码并且不希望人们窃取它。
What is it about your server that you think its insecure?
您认为服务器不安全的地方是什么？
回答by Ed Heal
- Periodically check the open ports on you server
- Do not trust the data coming from the browser - verify it and validate it.
- Periodically do an audit of the processes on your machine and who can access them
- Only have files in the document root that should be accessible by the outside world. Include files etc should not exist here
- Check the log files periodically to check for suspect access.
- For PHP errors/warnings - find a mechanism that does not give the client (browser) any info what has gone wrong. Send that to yourself. This is true for MySql as well.
- 定期检查服务器上的开放端口
- 不要相信来自浏览器的数据 - 验证它并验证它。
- 定期审核您机器上的进程以及谁可以访问它们
- 文档根目录中只有可供外界访问的文件。此处不应存在包含文件等
- 定期检查日志文件以检查可疑访问。
- 对于 PHP 错误/警告 - 找到一种不会向客户端（浏览器）提供任何出错信息的机制。发给自己。MySql 也是如此。
回答by tere?ko
If the file-system on your server has been compromised, then all is already lost. The best you can do is restrict folders, which are writable by web-server's user.
如果您服务器上的文件系统遭到破坏，那么一切都已经丢失。您能做的最好的事情是限制网络服务器用户可写的文件夹。
Also keep the application code outside the DOCUMENT_ROOT. Publicly available should only be the file you actually intend to show user, or which would not show any sensitive informations: like an index.php file which contains and include ../app/bootstrap.php.
还将应用程序代码保留在DOCUMENT_ROOT. 公开可用的应该只是您实际打算向用户显示的文件，或者不会显示任何敏感信息的文件：例如包含 和 的 index.php 文件include ../app/bootstrap.php。
You could use Zend Guard, but this would impact owner of the code. You might not be always the one maintaining it.
您可以使用Zend Guard，但这会影响代码的所有者。您可能并不总是维护它。
