{"id":238,"date":"2010-10-24T10:08:27","date_gmt":"2010-10-24T18:08:27","guid":{"rendered":"https:\/\/www.bhavyatechnologies.com\/blog\/?p=238"},"modified":"2010-10-24T10:13:08","modified_gmt":"2010-10-24T18:13:08","slug":"protecting-your-php-source-code-with-ioncube-encoder-2","status":"publish","type":"post","link":"https:\/\/www.bhavyatechnologies.com\/blog\/protecting-your-php-source-code-with-ioncube-encoder-2\/","title":{"rendered":"Protecting Your PHP Source Code With ionCube Encoder"},"content":{"rendered":"

Encoding Your PHP Files<\/h2>\n

The ionCube PHP Encoder is a command-line script you run either one or more files, or on an entire set of folders. If you’re encoding an entire PHP application you would typically run it on the original source folder. The encoder will duplicate the entire tree, except the PHP code will be encoded.<\/p>\n

In the previous section I showed you what the encoded PHP code from a basic “Hello World” script looks like. The command I used to generate this encoded script is as shown in Listing 3.<\/p>\n

\n
Listing 3<\/strong> Basic usage of the encoder (listing-3.txt)<\/div>\n
\n
\n
\/usr\/local\/ioncube\/ioncube_encoder5 helloworld.php -o helloworld-enc.php<\/pre>\n<\/div>\n<\/div>\n<\/div>\n
In this example, the -o<\/code> specified the output location.  In this example I just created the encoded file in the same directory  with a different filename. Typically you would want to create the file  with the same filename as the original (without replacing the original  source code).<\/p>\n
To achieve this, set the input and output both to be a directory.  The encoder will automatically recurse through all directories in the  input directory and encode all PHP files.<\/p>\n
To demonstrate this, let’s assume helloworld.php<\/code> is in a directory called src<\/code>. Listing 4 shows the command we use to encode this entire path. The example outputs the encoded files to the build<\/code> directory.<\/p>\n
\n
Listing 4<\/strong> Encoding an entire directory (listing-4.txt)<\/div>\n
\n
\n
\/usr\/local\/ioncube\/ioncube_encoder5 src -o build<\/pre>\n<\/div>\n<\/div>\n<\/div>\n
We now have a directory called build<\/code> which is identical to src<\/code> except that the PHP files are encoded.<\/p>\n
Note:<\/strong> Even non-PHP files (such as images or stylesheets) are also copied as-is into the target directory.<\/div>\n
There are many other command-line options. You can discover some of these by running ioncube_encoder5<\/code> with no arguments. Additionally, the “Encoder User Guide API” document (available from here<\/a>) is extremely useful.<\/p>\n
Protecting Non-PHP Code<\/h2>\n
Depending on how your web application has been designed, there may  be some non-PHP files you would to prevent users from being able to  read. A good example of such files is XML files or Smarty template  files.<\/p>\n
The ionCube PHP Encoder includes an encryption<\/em> option. This  feature is used to protect non-PHP files (but it differs from the PHP  encoding since the output isn’t a bytecode format format).<\/p>\n
To encrypt files, the --encrypt<\/code> command-line option is  used. You can then specify a file pattern that will be encrypted. For  example, if you want to encrypt every file with extension tpl<\/code> you would specify --encrypt \"*.tpl\"<\/code>. Without doing so, the encoder would simply copy all tpl<\/code> files exactly as-is into the target directory.<\/p>\n
Listing 5 shows the command we can now type on our src<\/code> directory. The directory contains the helloworld.php<\/code> script and a template called index.tpl<\/code>.<\/p>\n
\n
Listing 5<\/strong> Encoding PHP files and encrypting template files (listing-5.txt)<\/div>\n
\n
\n
\/usr\/local\/ioncube\/ioncube_encoder5 src\/ -o build --encrypt \"*.tpl\"<\/pre>\n<\/div>\n<\/div>\n<\/div>\n
Let’s now take a look at what effect this had on the source code. Listing 6 shows the original template file.<\/p>\n
\n
Listing 6<\/strong> A template before being encrypted (index.tpl)<\/div>\n
\n
\n
{foreach from=$myArr item=row}\r\n    {$row}\r\n{\/foreach}<\/pre>\n<\/div>\n<\/div>\n<\/div>\n
Now when we run the command from Listing 5, not only is the PHP script encoded, the index.tpl<\/code> file is encrypted. Listing 7 shows what the encrypted file may look like.<\/p>\n
\n
Listing 7<\/strong> An encrypted template file (index.tpl)<\/div>\n
\n
\n
!odMbo!\r\noGkVHCn70iD3x0iNno6StW4000000000pkStDhZrw5wtaVwr8YByvTkxU\/tMRAa8JBW2sOPu5OTW\r\nYk1KK+DyvUiMDXg2Wasd9IU12Kno0p0HeaPHg8258DO=1<\/pre>\n<\/div>\n<\/div>\n<\/div>\n
Your application must be able to handle these encrypted files.  Fortunately, when a loader is present in a PHP installation, a number of  additional functions are made available that allow you to deal with  encrypted files.<\/p>\n
The ioncube_read_file()<\/code> will decrypt files that have  been previously encrypted. This function accepts a filesystem path as  its only argument and will return the decrypted data. If the input path  was not encrypted it will be returned as-is.<\/p>\n
Note:<\/strong> The ioncube_read_file()<\/code> method  will only work from within an encoded PHP file. Additionally, it can  only decrypt files that were encrypted with the same encoder that  encoded the PHP file. This prevents other people from being able to  decrypt your files.<\/div>\n
Since we encrypted a Smarty template in the previous example, let’s  take a quick look at the changes required to Smarty to read encrypted  files. The ionCube website<\/a> contains notes on patching Smarty so it is compatible. This change ensures ioncube_read_file()<\/code> is available, meaning you can used the patched version in applications whether or not they’re encoded.<\/p>\n
The API also includes a ioncube_write_file()<\/code> function  which allows you to directly write encrypted data from within your  application. This allows you to protect data generated by your  application.<\/p>\n
The API user guide documents a number of other PHP functions that are available to you.<\/p>\n
Summary<\/h2>\n
In this article I showed you how you can protect your PHP code using  the ionCube PHP Encoder. While I only showed your the absolute basics,  there are many other features available with the encoder that make it  ideal for projects of all sizes.<\/p>\n
Some of those features include:<\/p>\n