Encoding PHP Files to Protect your PHP Application

How to Use a PHP Encoding Utility

We tasked ourselves with encoding of a simple PHP application and took Nu-Coder 2.0 for the ride along using the User Interface in PhpED 5.5. Our test PHP Application is a simple login form consisting of 3 php files and a style sheet. Here is how our project looks like in PHP IDE:

(PHP Encode Project - Click to Enlarge)

Now that we wrote the code we are ready to encode our php files and deploy them. For the sake of the simplicity we will deploy encoded php files on the same Windows box where we are running PhpED. However the files encoded with Nu-Coder can run on Linux, Unix and Mac OS as well.

We found Nu-Coder 2.0 to be highly configurable. You can encode the entire directories or just a single file, exclude the files from encoding, tell Nu-Coder to copy encoded files to another directory or change their extension and much more. All of these configurations are available in Nu-Coder's Command Line Interface described in NuSphere's PHP Encoder User Guide. However, we didn't have to read the manual to encode our application because the User Interface to Nu-Coder from PhpED is quite straightforward.

Encoding PHP Project

Nu-Coder is integrated with PhpED on the Project Level. All Encoder configurations can be done in Encoder tab of PhpED's Project Properties dialog. New UI in PhpED 5.5 provides the interface to both encoder and License Manager. Encoder tab of Project Properties has Destination group of options used to specify where you want to store your encoded files and 5 sub-tabs used to specify the way you want to encode the files.

Encoding PHP files Options

(PHP Encode Options - Click to Enlarge)

We chose to simply copy encoded files to a different directory under DocumentRoot of Apache. Actually, we found that "Remote servers - encode before upload" should be very useful for production deployment, which works together with PhpED's built in FTP/SFTP client, even though we didn't use it for our review. The UI is straightforward so we will mention only some of the settings we selected, like "Preserve extended info for debugging/profiling". We attempted to debug encoded files using NuSphere's PHP Debugger and eventually succeeded causing on the way NuSphere to publish a little tutorial on "How to Debug Encoded Files". We didn't do profiling of encoded php script, so if you want to take a look at it - feel free to post your findings in php editors forums or submit your review to us.

Encoding PHP files Protection

Next, we enabled licensing for our application and chose basic obfuscation. Nu-Coder doesn't support any other levels of obfuscation at the moment, we are hoping to see it in the not so distant future.

(PHP Encode Protection Tab - Click to Enlarge)

Encoding PHP files Exclusion

Next tab is Exclusions - which as we find out is especially useful for keeping the license error handling files out of license enforcement. Not doing so would result in ironic circular reference situation, when php script designed to inform the user about something like expired licenses requires the very licenses that just got expired

(PHP Encode Exclusion Tab - Click to Enlarge)

Encoding PHP files Header

Using the header tab we specified a simple custom header to be shown to the user in case if the loader PhpExpress is not installed.

(PHP Encode Header Tab - Click to Enlarge)