Minify / Obfuscate PHP Code [closed]

Question

I use Haxe to generate PHP code. (This means you write you code in the Haxe language and get a bunch of php files after compiling.) Today a customer told me that he needs a new feature on a old project made with Haxe. He also told me that he altered some small things on the code for his own needs. Now I first have port his changes to my Haxe code and then add the new feature, because otherwise his changes will be overwritten by the next time I compile the project.

To prevent that this happens again I am looking for some kind of program that minifies / obfuscates the PHP code. The goal is to make the code unreadable / uneditable as possible.
The ideal tool would run under Linux and could process whole folders and all it containing files.

Anybody any suggestions?

Schlock

Answer 1

I agree with the comment, what you are doing is very underhanded, but after 10 years in this biz I can attest to one thing: Half the code you get is so convoluted it might as well have been minified, and really function/var names are so often completely arbitrary, i've edited minified js and it wasn't much more of a hassle than some unminified code.

I couldn't find any such script/program, most likely because this is kind of against the PHP spirit and a bit underhanded, never the less.

First: Php isn't white space sensitive, so step one is to remove all newlines and whitespace outside of string.

That would make it difficult to mess with for the average tinkerer, an intermediate programmer would just find and replace all ;{} with $1\n or something to that effect.

The next step would be to get_defined_functions and save that array (The 'user' key in the returned array), you'll need to include all of the files to do this.

If it's oo code, you'll need get_defined_classes as well. Save that array.

Essentially, you need to get the variables, methods, and class instances, you'll have to instantiate the class and get_object_vars on it, and you can poke around and see that you can get alot of other info, like Constants and class vars etc.

Then you take those lists, loop through them, create a unique name for each thing, and then preg_replace, or str_replace that in all of the files.

Make sure you do this on a test copy, and see what errors you get.

Though, just to be clear, there is a special place in hell reserved for people who obfuscate for obfuscation's sake.

Check out: get_defined_functions get_declared_classes and just follow the links around to see what you can do.

Chaddie

If you are looking for specific instances of code, this is simple str = file_get_contents(filename) and str = preg_replace('/function $var/', ...) You catch my drift. Just look up these functions on php.net and you'll have all you need. – Chaddie

If you need help with regex's for the replaces, use gskinner's awesome gskinner.com/RegExr – Chaddie

We are talking about auto generated code, this already looks quite obfuscated. I would not spend a second to modify this code. Do blame the creators of a c compiler for creating obfuscated binaries? – Schlock

Good luck, hope you find what you are looking for :) – Chaddie

Answer 2

Why not use the php buid in function php_strip_whitespace()

string php_strip_whitespace ( string $filename )

Returns the PHP source code in filename with PHP comments and whitespace removed. This may be useful for determining the amount of actual code in your scripts compared with the amount of comments. This is similar to using php -w from the commandline.

Discipline

I tried your idea github.com/basselin/php-minify, it's worked great ! Thanks – Chesnut

Answer 3

We use Zend Guard to encode our PHP code with certain clients, but as Parrots said, you need to be sure you own the code. We only encode in certain situations, and only when it's explicit that we retain ownership of the code, otherwise Parrots is right, the client has a right to modify it.

Asbestosis

this is a little bit overkill, i am looking for something like stripping whitespaces an renaming variables. – Schlock

@ctyshrock: "the client has a right to modify it?" This isn't about morals, just what is allowed. Client only has a "right" to modify if the agreed upon software license allows that. There are software licenses where that is strictly forbidden, even if the code is supplied in source form. Whether the business model allows or forbids code modification depends on the how the owners see managing the product. – Aric

OMG! "the client has a right to modify it?" @Asbestosis you are really really wrong the client does NOT have the right to modify it, at all, really you need to learn copyright law.. the author of all works ALWAYS always retains rights over the work and it may not be modified, in fact, in law even if a customer bought it, if he didn't sign an EULA then in theory you can sue them as the author even after they bought it. (They'd have to go to court and try to get the court to rule "fair use" anything outside that is sueable) there is no justification for propagating an oft-quoted (dangerous) lie – Kiushu

Answer 4

I know of Zendguard, Expressionengine used it to encrypt their trial version's core code. You could always give that a go although you need to pay for it.

However, while I understand the frustration of having to port his changes, I assume they purchased the code from you? They have the right to modify it. You just have the right to charge them extra to port their changes ;) Imagine if you stopped working for them, how could they ever hire someone else to update the code?

Leeway

the could have asked me, I have done it for free. Or they could have taken the haxe files from the shared subversion ;-) – Schlock

+1 but, just to be awkward - yes, they purchased the code - but if you only ever deliver obfuscated code, then that is what they purchased. Unless you explicitly sell it as a development platform, I don't see a problem. But you can be 100% sure that if you deliver cleartext code and they modify it then you will get the support headaches and they generally won't be prepared to pay. – Barograph

If you deliver cleartext and a software license that says they aren't allowed to fiddle with it, then you have no obligation to fix it. In this case, shipping obfuscated code helps discourage what should already be spelled out in the license agreement. If you "sell" them the source code, then you can expect to both to modify it and give it to third parties without your permission, for the usual meaning of "sell". – Aric

Answer 5

Our PHP Obfuscator does exactly the the job of stripping comments, whitespaces, and scrambling identifiers.

It operates across a complete set of PHP files to ensure that scrambled symbols are scrambled consistently across those files, ensuring correct operation even after scrambling.

EDIT 2013: Now encrypts string literals to make them unreadable. Operates under Windows, and on Linux under Wine.

Aric

Answer 6

You can try PHP Obfuscator or the bcompiler PHP extension.

Blatt

Thanks for PHP Obfuscator link, but it is Windows only and does not work properly. – Schlock

Answer 7

I have just find minify-service for PHP. It's really looks usefull. They says, that obfuscating will be available soon. I hope this is true :) http://customhost.com.ua/php-minify/

Garlandgarlanda

this would be ideal, but it doesn't strip my // comments. I'm now looking at aciddrop.com/php-speedy – Ancilla

3 years later Coming soon: variables obfuscating – Precaution

link above doesn't work for me (404) – Galosh