Protecting Your PHP Source Code With ionCube Encoder

By Quentin Zervaas, 8 June 2010 PHP Download PDF (1 comment)

Protecting Non-PHP Code

Depending on how your web application has been designed, there may be some non-PHP files you would to prevent users from being able to read. A good example of such files is XML files or Smarty template files.
The ionCube PHP Encoder includes an encryption option. This feature is used to protect non-PHP files (but it differs from the PHP encoding since the output isn't a bytecode format format).
To encrypt files, the --encrypt command-line option is used. You can then specify a file pattern that will be encrypted. For example, if you want to encrypt every file with extension tpl you would specify --encrypt "*.tpl". Without doing so, the encoder would simply copy all tpl files exactly as-is into the target directory.
Listing 5 shows the command we can now type on our src directory. The directory contains the helloworld.php script and a template called index.tpl.

Listing 5 Encoding PHP files and encrypting template files (listing-5.txt)

/usr/local/ioncube/ioncube_encoder5 src/ -o build --encrypt "*.tpl"

Let's now take a look at what effect this had on the source code. Listing 6 shows the original template file.

Listing 6 A template before being encrypted (index.tpl)

{foreach from=$myArr item=row}
    {$row}
{/foreach}

Now when we run the command from Listing 5, not only is the PHP script encoded, the index.tpl file is encrypted. Listing 7 shows what the encrypted file may look like.

Listing 7 An encrypted template file (index.tpl)

!odMbo!
oGkVHCn70iD3x0iNno6StW4000000000pkStDhZrw5wtaVwr8YByvTkxU/tMRAa8JBW2sOPu5OTW
Yk1KK+DyvUiMDXg2Wasd9IU12Kno0p0HeaPHg8258DO=1

Your application must be able to handle these encrypted files. Fortunately, when a loader is present in a PHP installation, a number of additional functions are made available that allow you to deal with encrypted files.
The ioncube_read_file() will decrypt files that have been previously encrypted. This function accepts a filesystem path as its only argument and will return the decrypted data. If the input path was not encrypted it will be returned as-is.

Note: The ioncube_read_file() method will only work from within an encoded PHP file. Additionally, it can only decrypt files that were encrypted with the same encoder that encoded the PHP file. This prevents other people from being able to decrypt your files.

Since we encrypted a Smarty template in the previous example, let's take a quick look at the changes required to Smarty to read encrypted files. The ionCube website contains notes on patching Smarty so it is compatible. This change ensures ioncube_read_file() is available, meaning you can used the patched version in applications whether or not they're encoded.
The API also includes a ioncube_write_file() function which allows you to directly write encrypted data from within your application. This allows you to protect data generated by your application.
The API user guide documents a number of other PHP functions that are available to you.

• Next: Summary