Developing proprietary apps in PHP

[Ben]

I'm new to PHP. The ease of use, power, flexibility and low overhead to run
it is amazing. I am tempted to convert my entire software to PHP but have a
few questions and concerns before heading down this path.

In short my program provides specialized web-based reporting and statistical
analysis using a variety of data sources. All of these data sources can be
converted fed to a centralized MySQL DB easily using VFP (no VFP comments
please). My major concern is this "open source" PHP philosophy being in a
very competitive and very propriety niche industry. Is it true that anyone
accessing a PHP program on the net can easily download all source? Are
there any protections for proprietary code or does that go against the very
nature of PHP?

I like PHP but can not throw this application to the wolves. I've narrowed
my decision down to PHP or VB.NET and definitely prefer PHP.

Any comments are appreciated.

- Ben

[Colin McKinnon]

Ben wrote:

please). My major concern is this "open source" PHP philosophy being in a
very competitive and very propriety niche industry. Is it true that
anyone
accessing a PHP program on the net can easily download all source?
Nope.
Are
there any protections for proprietary code or does that go against the
very nature of PHP?

Code is usually distributed as source but can be rendered totally unreadable
using encoders available from Zend, Ioncube and possibly others.

HTH

C.

[David Gillen]

An noise sounding like Colin McKinnon said:

Code is usually distributed as source but can be rendered totally unreadable
using encoders available from Zend, Ioncube and possibly others.

Stick PHP obfuscator into google and you'll get a few results.

Remember to keep a copy of your original source code though. Otherwise you'll
be just a f*$%ed. ;)

db
--

/(bb|[^b]{2})/
Trees with square roots don't have very natural logs.

[Geoff Berrow]

I noticed that Message-ID:
<sl*******************@carbon.redbrick.dcu.ie> from David Gillen
contained the following:

Stick PHP obfuscator into google and you'll get a few results.

I write self-obfuscating code.. ;-}

--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[Ben]

"Geoff Berrow" <bl******@ckdog.co.uk> wrote in message
news:9r********************************@4ax.com...

I noticed that Message-ID:
<sl*******************@carbon.redbrick.dcu.ie> from David Gillen
contained the following:
So what you guys are saying is that a PHP app is basically out there for
anyone to read, copy and repackage and sell at will?

Stick PHP obfuscator into google and you'll get a few results.

I write self-obfuscating code.. ;-}

--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[Geoff Berrow]

I noticed that Message-ID: <IL****************@twister.rdc-kc.rr.com>
from Ben contained the following:

So what you guys are saying is that a PHP app is basically out there for
anyone to read, copy and repackage and sell at will?

It's an interpreted language, so basically, yes.

--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[Nik Coughin]

Ben wrote:

"Geoff Berrow" <bl******@ckdog.co.uk> wrote in message
news:9r********************************@4ax.com...

I noticed that Message-ID:
<sl*******************@carbon.redbrick.dcu.ie> from David Gillen
contained the following:

So what you guys are saying is that a PHP app is basically out there
for anyone to read, copy and repackage and sell at will?

Ben:

http://www.zend.com/store/products/zend-encoder.php

[Ben]

"Geoff Berrow" <bl******@ckdog.co.uk> wrote in message
news:kt********************************@4ax.com...

I noticed that Message-ID: <IL****************@twister.rdc-kc.rr.com>
from Ben contained the following:

So what you guys are saying is that a PHP app is basically out there for
anyone to read, copy and repackage and sell at will?
It's an interpreted language, so basically, yes.

Thanks for being so up front.

Off topic: So my choices are basically limited to .NET, CGI and Perl?
Important factors to me are relative security of code (I realize any code
can be hacked), low overhead (as far as server side software) and ability to
find coders to outsource. At a cross roads now where my coding ability is
nearly obsolete. Would rather focus on design/marketing and outsource the
coding to experts like yourself instead of beginning the 1-2 year road to
master another language.

Any feedback is appreciated.

- Ben
--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[Dave Patton]

"Ben" <[e-mail]> wrote in news:IL****************@twister.rdc-kc.rr.com:

So what you guys are saying is that a PHP app is basically out there for
anyone to read, copy and repackage and sell at will?

The answer is .... it depends.

If by "app" you mean a web-based application where the
PHP scripts will be executed on your webserver and people's
interaction with the "application" will be via their browser,
then barring security issues, people will never see the
PHP code, because the webserver parses it and produces
HTML pages.

If you mean you write a 'standalone' application using
PHP, and plan to distribute it, so that people can then
install PHP and run your application, then unless you
use one of the available methods to 'hide' your PHP
code, yes, people will be able to see your PHP source code.

As for "repackage and sell at will", you can put limits
on that with how you licence your application.

--
Dave Patton
Canadian Coordinator, Degree Confluence Project
http://www.confluence.org/
My website: http://members.shaw.ca/davepatton/

[Geoff Berrow]

I noticed that Message-ID: <Pp*****************@twister.rdc-kc.rr.com>
from Ben contained the following:

It's an interpreted language, so basically, yes.

Thanks for being so up front.

Off topic: So my choices are basically limited to .NET, CGI and Perl?

Well Perl is interpreted too and so is .NET I think. See Dave Patton's
post for a more complete answer

--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[Wayne]

On Tue, 08 Feb 2005 19:52:08 GMT, "Ben" <[e-mail]> wrote:

"Geoff Berrow" <bl******@ckdog.co.uk> wrote in message
news:9r********************************@4ax.com.. .

I noticed that Message-ID:
<sl*******************@carbon.redbrick.dcu.ie> from David Gillen
contained the following:

So what you guys are saying is that a PHP app is basically out there for
anyone to read, copy and repackage and sell at will?

Assuming you distribute it. Our company hosts our PHP applications --
in which case the source is safe.

[Chung Leong]

"Geoff Berrow" <bl******@ckdog.co.uk> wrote in message
news:kt********************************@4ax.com...

I noticed that Message-ID: <IL****************@twister.rdc-kc.rr.com>
from Ben contained the following:

So what you guys are saying is that a PHP app is basically out there for
anyone to read, copy and repackage and sell at will?

It's an interpreted language, so basically, yes.

--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

I think you guys are confusing the OP. The way I understand his question is
whether the source code of a program written in PHP is automatically
available for anyone to see and use. The answer to that is a definite no.

[swdev2]

Ben - don't forget DABO -
see http://dabo.leafe.com
hth - mondo regards [Bill]

--
William Sanders / Electronic Filing Group Remove the DOT BOB to reply via
email.
Mondo Cool TeleCom -> http://www.efgroup.net/efgcog.html
Mondo Cool WebHosting -> http://www.efgroup.net/efglunar.html
Mondo Cool Satellites -> http://www.efgroup.net/sat
VFP Webhosting? You BET! -> http://efgroup.net/vfpwebhosting
mySql / VFP / MS-SQL

"Ben" <[e-mail]> wrote in message
news:Pp*****************@twister.rdc-kc.rr.com...

"Geoff Berrow" <bl******@ckdog.co.uk> wrote in message
news:kt********************************@4ax.com...

I noticed that Message-ID: <IL****************@twister.rdc-kc.rr.com>
from Ben contained the following:

So what you guys are saying is that a PHP app is basically out there foranyone to read, copy and repackage and sell at will?
It's an interpreted language, so basically, yes.

Thanks for being so up front.

Off topic: So my choices are basically limited to .NET, CGI and Perl?
Important factors to me are relative security of code (I realize any code
can be hacked), low overhead (as far as server side software) and ability

to find coders to outsource. At a cross roads now where my coding ability is
nearly obsolete. Would rather focus on design/marketing and outsource the coding to experts like yourself instead of beginning the 1-2 year road to
master another language.

Any feedback is appreciated.

- Ben

--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[Geoff Berrow]

I noticed that Message-ID: <L-********************@comcast.com> from
Chung Leong contained the following:

I think you guys are confusing the OP. The way I understand his question is
whether the source code of a program written in PHP is automatically
available for anyone to see and use. The answer to that is a definite no.

One expects someone talking about proprietary apps to have a good
understanding of the process. Apologies for any confusion.

--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[Ben]

"Wayne" <no*@here.com> wrote in message
news:40********************************@4ax.com...

On Tue, 08 Feb 2005 19:52:08 GMT, "Ben" <[e-mail]> wrote:

"Geoff Berrow" <bl******@ckdog.co.uk> wrote in message
news:9r********************************@4ax.com.. .

I noticed that Message-ID:
<sl*******************@carbon.redbrick.dcu.ie> from David Gillen
contained the following:

So what you guys are saying is that a PHP app is basically out there for
anyone to read, copy and repackage and sell at will?

Assuming you distribute it. Our company hosts our PHP applications --
in which case the source is safe.

This is what I was after! Ok, so the PHP application source code is as safe
as the server that is running it correct? I aplogize for my ignorance about
this and do think I understand now. Never written anything that wasn't
compiled and encrypted to a single .exe except HTML. I was under the
impression that since PhP is not compiled the code itself can be easily
accessed by anyone RUNNING the application through a browser. Based on the
feedback from this thread (thank you so much) my understanding is now...

While PHP is plain text and can be easily read by anyone with rights to the
folder where the PHP code physically resides, it is not possible for a user
running the application through a browser to see it. So the best practice
for someone wanting to sell a PHP application is to have the application
running from a secure server where the clients have access only through a
browser (whether LAN or Internet). And either option should include a tight
EULA (obviously).

True?

[gumshoo3]

Every few releases the same JSP bug creeps back into the front-end
processor for a number of Java servers, that is you tag a "/" or some
extraneous character on to the end of the URL, and you get the source
file back instead of the compiled page. They keep fixing that and it
keeps coming back. I believe the same recurrent bug afflicted ASP as
well. It's like the developers kept putting it back in.

Don't know if it ever happened with PHP, as I'm a newbie as well.
Would be interesting if such a recurrent bug had something to do with
the development process for a commercial product.

I'm a little curious as to why you "definitely like PHP better" than
ASP.NET. Would you share your insights (those tactile realizations
when your feet hit the ground)?

[Anonymous]

Ben wrote:

accessed by anyone RUNNING the application through a browser. Based on the
feedback from this thread (thank you so much) my understanding is now...

While PHP is plain text and can be easily read by anyone with rights to the
folder where the PHP code physically resides, it is not possible for a user
running the application through a browser to see it. So the best practice
for someone wanting to sell a PHP application is to have the application
running from a secure server where the clients have access only through a
browser (whether LAN or Internet). And either option should include a tight
EULA (obviously).

True?

Bingo!

But LAN isn't that great, because if the server is residing in the same
building as the client they could physically access the server at any
time. Simply boot it up with some sort of bootdisk or CD and check the
source. You can't really check what they are doing with the server this
way.

If you want to add an additional layer of protection you might want to
check out the Zend Encoder.
http://www.zend.com/store/products/zend-encoder.php

It is expensive though and I don't have any experience with it, I just
heard of it. Perhaps some other people here can share their experiences
with it and tell you whether it is worth the cost.

OTOH, if the application you plan is very valuable any layer of
protection that is not too easy to break might be worth the cost.

Bye!

[Ben]

<gu******@yahoo.com> wrote in message
news:11**********************@z14g2000cwz.googlegr oups.com...

Every few releases the same JSP bug creeps back into the front-end
processor for a number of Java servers, that is you tag a "/" or some
extraneous character on to the end of the URL, and you get the source
file back instead of the compiled page. They keep fixing that and it
keeps coming back. I believe the same recurrent bug afflicted ASP as
well. It's like the developers kept putting it back in.

Don't know if it ever happened with PHP, as I'm a newbie as well.
Would be interesting if such a recurrent bug had something to do with
the development process for a commercial product.

Will leave above to the experts. But wanted to comment on your question
below. One word...overhead.
I'm a little curious as to why you "definitely like PHP better" than
ASP.NET. Would you share your insights (those tactile realizations
when your feet hit the ground)?

My own personal experience shows that Microsoft is very good at milking you
on both initial investment and upgrades. I'd like to avoid that trap if
possible. Its a tough business descision to deviate from a key buzz word
potential clients with no real technical understanding like to hear (ex: VB,
..NET, C++, etc.). Again from my own experience I've had a rough time
pushing a product written in Visual Fox (for 10 years now) when my clients
think VB/SQL is better. In the end the truth will set ya free though right?
And it has. We deal with million record DB's on a regular basis and have
never, not once had corruption, our application is deployed with minimal
turn around and overhead and the time to crunch data benchmarks speak for
themselves. The major drawback I see with PHP though is I'll be fighting
the same battle if I go down this path. My competitors all use .NET...bunch
of sheep! (kidding)

The overhead factors with PHP are undeniable. Speaking of initial software
costs, other software that is required and upgrades. I can deploy a
Internet based application with DB functionality hosted on my existing ISP
for nearly zero software investment with PHP. The only overhead is time.
Going down the Microsoft path that simply can not be done, legally.

My rational is this. If I can achieve equal or better functionality,
development time, security, reliability and overall speed using PhP vs .NET
the only reason to use .NET is for the buzz word. I don't have a huge bank
account to draw on so my descision is all but made.

Just being honest about MY perspective. Feel free to disagree I'm
interested in hearing any perspective.

- Ben

[gumshoo3]

gee thanks. That's some valuable insight. For me the overhead is the
stack of 15 cds you have to install to get up and running in .NET. Not
to mention the hunting around for required files from the Windows
distribution.

I took a free copy of Visual C# .NET home to show off to my 15-year-old
kid, a spiffy dev environment, programming language etc.

5 cds. Tried to install it, started asking for OS files. Forget it.
I consider that an IT failure.

Have WAMP stack(XAMPP) and tiki and a bunch of other stuff all on 1 CD,
will set the kids loose on that.

There's probably a million young people being productive in PHP in
Europe...

[Ben]

<gu******@yahoo.com> wrote in message
news:11*********************@l41g2000cwc.googlegro ups.com...

gee thanks. That's some valuable insight.
LOL that sounded sarcastic. Did you not read the full response below? (see
prev thread) Anyway sounds like we're about on the same page. My issues are
functionality, reliability, money and time to deploy. Again, see previous.

Thanks,

- Ben
For me the overhead is the
stack of 15 cds you have to install to get up and running in .NET. Not
to mention the hunting around for required files from the Windows
distribution.

I took a free copy of Visual C# .NET home to show off to my 15-year-old
kid, a spiffy dev environment, programming language etc.

5 cds. Tried to install it, started asking for OS files. Forget it.
I consider that an IT failure.

Have WAMP stack(XAMPP) and tiki and a bunch of other stuff all on 1 CD,
will set the kids loose on that.

There's probably a million young people being productive in PHP in
Europe...

[gumshoo3]

No sarcasm intended. Read your entire response twice. I wrote too
many ornaments in the words of my response I guess, always a risk
they'll get altered in tone at the recieving end of the channel :-)

[NC]

Ben wrote:

Is it true that anyone accessing a PHP program on the net
can easily download all source?
No. When you access PHP (or ASP, or JSP, or Perl) script over
HTTP, you only get its output. The script is executed on the
server side. This said, if you plan to sell your application,
you will have to deliver it to buyers in source code, which
makes some developers uneasy.
Are there any protections for proprietary code or does that
go against the very nature of PHP?
There are three lines of thinking on the subject:

1. Code obfuscators make code poorly readable by changing
variable names to seemingly random sequences of letters
and numbers, deleting indents and comments, etc. This
makes reverse engineering more difficult, but not
impossible.
2. PHP encoders (Zend, IonCube, SourceGuardian, and quite
a few others) translate the source code into the
intermediary byte code, which the PHP interpreter can
process faster than it processes the cource code.
This allows developers to distribute only byte code,
but not source code.
3. PHP compilers (so far, I am only aware of one true PHP
compiler, developed by Roadsend) produce native source
code that can presumably run on a computer that does
not have PHP support; only an HTTP server is needed.

Somewhere between 2 and 3, there is a very interesing project
called Phalanger, which translates PHP into MSIL (Microsoft
Intermediate Language) byte-code and metadata, which allows
to develop .NET applications in PHP and even enables PHP
development in Microsoft Visual Studio .NET. If you have
Phalanger integrated into Microsoft Visual Studio .NET, you
can produce binary executables (Phalanger compiles PHP into
MSIL, then Visual Studio produces executables).
I've narrowed my decision down to PHP or VB.NET and
definitely prefer PHP.

Well, these days, you no longer have to choose. You can develop
in PHP, then use Phalanger to produce .NET assemblies and make
your product available in both versions...

Cheers,
NC

[Wayne]

On Wed, 09 Feb 2005 14:04:04 GMT, "Ben" <[e-mail]> wrote:

While PHP is plain text and can be easily read by anyone with rights to the
folder where the PHP code physically resides, it is not possible for a user
running the application through a browser to see it.
Yes. PHP always exists as source code, it's "compiled" when run, and
the *output* only is sent to the browser. It's never possible for the
user to see the source code via a browser.
So the best practice
for someone wanting to sell a PHP application is to have the application
running from a secure server where the clients have access only through a
browser (whether LAN or Internet). And either option should include a tight
EULA (obviously).

Yup. In at least one case we've distributed the application to a
client on their machine. The source code wide open to the world but
they had to sign an extensive license. We feel pretty safe with that
-- if they ever screwed around with it we'd just sue them. ;)

Later,

[Ben]

"NC" <[e-mail]> wrote in message
news:11**********************@l41g2000cwc.googlegr oups.com...

Ben wrote:

Thank you for the explanations, extremely helpful.
Is it true that anyone accessing a PHP program on the net
can easily download all source?

No. When you access PHP (or ASP, or JSP, or Perl) script over
HTTP, you only get its output. The script is executed on the
server side. This said, if you plan to sell your application,
you will have to deliver it to buyers in source code, which
makes some developers uneasy.

Are there any protections for proprietary code or does that
go against the very nature of PHP?

There are three lines of thinking on the subject:

1. Code obfuscators make code poorly readable by changing
variable names to seemingly random sequences of letters
and numbers, deleting indents and comments, etc. This
makes reverse engineering more difficult, but not
impossible.
2. PHP encoders (Zend, IonCube, SourceGuardian, and quite
a few others) translate the source code into the
intermediary byte code, which the PHP interpreter can
process faster than it processes the cource code.
This allows developers to distribute only byte code,
but not source code.
3. PHP compilers (so far, I am only aware of one true PHP
compiler, developed by Roadsend) produce native source
code that can presumably run on a computer that does
not have PHP support; only an HTTP server is needed.

Somewhere between 2 and 3, there is a very interesing project
called Phalanger, which translates PHP into MSIL (Microsoft
Intermediate Language) byte-code and metadata, which allows
to develop .NET applications in PHP and even enables PHP
development in Microsoft Visual Studio .NET. If you have
Phalanger integrated into Microsoft Visual Studio .NET, you
can produce binary executables (Phalanger compiles PHP into
MSIL, then Visual Studio produces executables).

I've narrowed my decision down to PHP or VB.NET and
definitely prefer PHP.

Well, these days, you no longer have to choose. You can develop
in PHP, then use Phalanger to produce .NET assemblies and make
your product available in both versions...

Cheers,
NC

[Chung Leong]

"Geoff Berrow" <bl******@ckdog.co.uk> wrote in message
news:hf********************************@4ax.com...

I noticed that Message-ID: <L-********************@comcast.com> from
Chung Leong contained the following:

I think you guys are confusing the OP. The way I understand his question iswhether the source code of a program written in PHP is automatically
available for anyone to see and use. The answer to that is a definite no.

One expects someone talking about proprietary apps to have a good
understanding of the process. Apologies for any confusion.

In the MS development world, ignorance is strength :-)

[R. Rajesh Jeba Anbiah]

NC wrote:
<snip>

I've narrowed my decision down to PHP or VB.NET and
definitely prefer PHP.
Well, these days, you no longer have to choose. You can develop
in PHP, then use Phalanger to produce .NET assemblies and make
your product available in both versions...

Very useful post indeed; never heard this stuff before.
Cheers,
NC

Hmm... for me, it took sometime to recognize Nikolai Chuvakhin:-)

--
<?php echo 'Just another PHP saint'; ?>
Email: rrjanbiah-at-Y!com Blog: http://rajeshanbiah.blogspot.com/

[NC]

R. Rajesh Jeba Anbiah wrote:

NC wrote:

Well, these days, you no longer have to choose. You can develop
in PHP, then use Phalanger to produce .NET assemblies and make
your product available in both versions...

Very useful post indeed; never heard this stuff before.

Check it out:

http://www.php-compiler.net/

If I understand correctly, it has been developed by a buncn
of math and physics students at Univerzita Karlova in Prague.

Cheers,
NC

Hmm... for me, it took sometime to recognize Nikolai Chuvakhin:-)

When Google went from the original Groups application to
Groups 2 (which I, for variety of reasons, like much less
than the original one), my name in message headers somehow
got truncated to initials. I wonder if Groups 2 hates me
back because I hate it... :)

Cheers,
NC

[R. Rajesh Jeba Anbiah]

NC wrote:
<snip>

Cheers,
NC

Hmm... for me, it took sometime to recognize Nikolai Chuvakhin:-)

When Google went from the original Groups application to
Groups 2 (which I, for variety of reasons, like much less
than the original one), my name in message headers somehow
got truncated to initials. I wonder if Groups 2 hates me
back because I hate it... :)

Yes, everybody hate that stupid GG2. But, probably you may want to
set your display name/nick at
<http://groups-beta.google.com/groups/mysubs> ?

--
<?php echo 'Just another PHP saint'; ?>
Email: rrjanbiah-at-Y!com Blog: http://rajeshanbiah.blogspot.com/