Protecting Intellectual Property of PHP

[omegadm]

This is something that has bothered me for some time and prevented me from fully exploring the power I know exists in php. At present any bespoke programming is done with cgi/perl. The perl script(s) remain on our server so the client can use them but does not have access to the code.

I would like to re-write some programs in php, but onced placed in the clients' area, the client can walk off with them when-ever they wish. It happened quite recently - not because the client wasn't happy with our work, but simply that they now have a full time member of staff doing the work in-house. Its their server, so they have taken over our php scripts...

I guess the key is price?
We charge a reasonable fee to develop an internet solution, but I do not want this to mean handing over the Intellectual Property for the work.

Does anyone have any ideas on this conundurum?
I have looked at Zend.org, but this is really for commercial software that you then market as a stand alone product. We don't do that.

I am looking for some ideas of best practise - perhaps contract wording? Or are developers and designers simply handing over coded pages?

Cheers, Brian

[eaden]

Check out IonCube.

It encodes php, and they have a free online demo that will encode it for 8 hours. It is a lot cheaper than the zend one.

Encoding is the only reliable and secure way to do this. I run my own server for this reason.

[jatar_k]

I pretty much hand over the code but the scripts/programs are priced accordingly to make one shot sales worth while. Zend is great stuff but presents its own issues and it isn't overly cheap.

I did hear an interesting story this past weekend of someone purchasing a script and all the var/function names were in hungarian. This protected the code fairly well since it made it extremely difficult to understand exactly what was going on.

[BCMG_Scott]

LOL - Hungarian vars! That's a good idea, could try the cyrillic (Russian) alphabet too maybe!

Contract wording is one option, but then you have to enforce it - and that means getting lawyers into the mix - not necessarily a cheap option.

One shot pricing could work too. Another pricing option is to have an upfront price and then require a yearly maintanence fee. That would include upgrades and bug fixes (if needed). You'd probably want contract wording as well.

I think the IonCube encryption option may be the best.

Scott

[TheWebographer]

I have looked into encoding files too but nothing seems satisfactory for one reason or another. Obfuscation could help a little, as in creating all the variables in hungarian *LOL - but any programmer worth his salt could still reverse engineer the thing.

One idea I have come up with is to keep the code and database on my own server - and call it from the server the customers website is hosted on. So basically they are paying for a liscense to access our server and the scripts located there that then output their dynamic site.

Any comments on this method?

[jatar_k]

If they are scripts that are posted to (search/forms/etc) then that would be fine. Their form posts to it and you return them to their site, seamless. If it is something that is integral to the normal function of their website on a page by page basis, bad plan. It would cause their site to slow down dependant on your load. A time out could wreak havoc.

Its a tough question, everyone has different ways of protecting their intellectual property and none are bulletproof. It would seem that you need to make the situation viable for your own situation. I try to provide good service and when they need something else they will come back.

[TheWebographer]

I played around with POBS - its an excellent Obfuscator. But the problem is with all that manipulation you run the danger of obfuscating it for yourself also!

[omegadm]

Cheers guys & gals

IonCube looks very impressive - I like the ability to restrict the ip address and time limit the license :))

You don't even have to modify the server (php.ini) either as it comes with its own loader - though perfomance would be better with it. The price is also very good...

Thanks again - I have been led to a very good product :))