1

I am selling PHP script online at 35$ for a individual user

Is there any way to identify whether , my script is hosted by more than one user ..

Should i use any logic in my script to find his identity?

Is there an easy way to find the pirator

Please help me. (sorry for grammatical mistakes)

2

5 Answers 5

1

For example, somewhere in your script:

<?php
file_get_contents('http://yourserver.com/tranck_script_users.php?site='.url_encode($_SERVER['HTTP_HOST']));
?>

This way you will see which hosts use your script. Of course, anyone can remove this line from your script, there is no 100% way to know for sure.

1

If you can, try to make simple calls to a server of yours to track the script usage, you should send the domain name and the IP. Use cURL for this. If your business logic permits this you can go as far as disabling the script functionality if tracking is not successful.

Because PHP is just plain text anyone can remove your tracking code portion. Try to obfuscate the code.

3
  • 2
    Awesome idea! Disable functionality for paid up customers when a slice of the backbone flips out, breaking the link to your tracking server, or your tracking server is down for maintenance, or you decide to shut up shop, or you get hit by a bus and your tracking server account gets cancelled. As a bonus, since anyone who's pirating your code will probably simply remove the tracking code anyway, restoring full functionality for their versions, this will only affect your paid up customers.
    – AllenJB
    Oct 6, 2010 at 12:43
  • As a matter of fact anything can be pirated. What matters if how hard it can be done. In the current case of a PHP script it's extremely easy. With just the script as he sells it the only effort needed is to get it from a paying customer. If he adds something to track the usage the pirate needs to look at the script and understand at least some part of it. If he also obfuscates it the effort needed increases.
    – Alin P.
    Oct 6, 2010 at 12:51
  • 1
    @ALlenJB since anyone who's pirating your code will probably simply remove the tracking code anyway, restoring full functionality for their versions, this will only affect your paid up customers. well, most anti-terrorism measures (e.g. no liquids and nailclippers on airplanes; eavesdropping on social networks etc. etc.) work the same way, so there must be some merit to this! :D
    – Pekka
    Oct 6, 2010 at 12:56
1

There is no reliable way in PHP to prevent someone else using your script. Because PHP uses just-in-time compilation, the source code can be read by anyone with access to the files. This means that any call-home logic you put into your script can easily be disabled. The best you can do is obfuscate it, but the code can still be edited by anyone with sufficient determination.

Your best solution is to use a good licence, or to develop in a language that can be distributed already compiled. With PHP, there is not a reliable way to prevent re-use of your source code.

I would urge you not to put any kind of call-home functionality into your script. First, it can be disabled, so is essentially useless. Second, it will cause significant delays even for legitimate users of your script. Finally, if you must put it in, it is vital that you tell your users that you are doing so.

8
  • 1
    I agree, never, never add call-home functionality in a script to prevent piracy. It's just a terrible idea!
    – AlexV
    Oct 6, 2010 at 12:50
  • I agree with you that this is generally not a good idea. But if you really want to do something with PHP it can help you. Also you could make the calls just sends and track who uses your script and when the user stops using it, giving you potential pirates. There should be some requests before the pirate realizes you are monitoring usage. As for the paying customer you can write in your license agreement that the script does that and if anyone complains you can supply a clean version.
    – Alin P.
    Oct 6, 2010 at 13:00
  • 1
    @Alin Yes, you can do it if you really, really want to. You just need to be aware that, in the end, it probably won't work. Oct 6, 2010 at 13:06
  • In the end means: for that one pirate that really, really doesn't want to pay for your software. You can do without him, but you will still have stopped some of them. Please remember that not everyone that uses pirated software is an action movie hacker.
    – Alin P.
    Oct 6, 2010 at 13:15
  • 1
    @Alin Purcaru What if your license server is down? What if the requests time-out? These requests slow down your application. Why in earth do you want to penalize paying customers? This kind of "security" is so trivial that in the end it's like locking the door and leaving the key back in the lock!
    – AlexV
    Oct 6, 2010 at 13:54
1

There isn't much you can do to negate piracy with non-compiled scripts. Anybody can modify the source to remove whatever protections you have in place. You can, however, try to run the script through some sort of obfuscation tool, or otherwise try to manually "encode" the file, in much the same way a lot of PHP malware does. Obfuscation and this type of encoding can and will be beaten by somebody with enough time on their hands, though.

If you're willing to invest some money into the problem, you could check out IonCube Encoder or Zend Guard. Both of which will secure your script, and I know at least Zend Guard allows for per-server licensing. These solutions would require your end-users to have either the IonCube or Zend loaders installed, though.

1

There is no way to do this without (IMO) impacting the security/privacy of your users.

The only "clean" way to do this is to encode your scripts with a tool like IonCube (there are many others but never used them) and restrict the execution on a specific domain. The downside (you can also see this as a plus depending of your license scheme) is that the users can't see/modify your code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.