Slashdot Mirror

> This is a Drupal module (PHP), so it *is* the code.
Not necessarily ; see http://www.ioncube.com/
That's a source code encryption tool that I've seen used several time in websites from clients of my hosting company.

Why is this excessively insecure?

Because said file has to be readable to user "nobody" in order to have an Apache child process read it. Because of that, ANY WEAKNESS in your scripting can result in a complete compromise of your data.

Here's the only method that I've found that offers ANY better for PHP:

1) Create a function that returns a database connection resource.

2) Within the function, include the login credentials.

3) Encrypt said file with with a "source protector", like IonCube Encoder or the Zend Encoder.

Now, you've limited the damage of a compromise so that an attacker would have to trick the application into actually making the request directly thru the function, rather than allowing attacker to actually access the DB directly.

It's not much - but can you do better?

You should check out PHPAudit for licensing and distribution (http://phpaudit.com/ and ionCube for encoding (http://ioncube.com/ if you plan to sell your product commercially.

Products like PHPAudit make PHP commercially viable as well. You can actually embed the licensing system into your PHP applications and use an encoder such as ionCube or Zend to create byte code that will protect your work from piracy.

No site should require compiled PHP code. If you need speed, get a cache extension like APC, Turck MMCache which are free, or Zend Accelerator or ionCube's accelerator if you require a commercial product with support.

If you need even faster code, write a PHP extension (in C, compiled) to handle your resource-intensive functions.

Both of those solutions are much more versatile than a compiler that doesn't support the full language.

Speaking of PHP compilers, there's a good and very affordable solution from IonCube as well.

(no, I have no affiliation to them)

Personally, I'd LOVE to be able to write Perl / GTK2 apps that run under Windows, and it looks like I might be able to soon

Dunno about Perl, but with PHP-GTK, I've been able to do this for over a year with PHP. Combined with the Ion Cube compiler, I've been writing cross-platform Windows/Linux/OSX programs for quite a while.

I'd be curious to know how PHP-GTK performs against JVM for client-side development.

I've developed some decent applications using PHP, I LOVE IT!

PHP is clean, straighforward, performs reasonably well, makes socket connections and multi-system communications a breeze, offers enough OO support to be useful, and doesn't mire one into the details of whether an "a" is an "a" or actually ord('a')...

One of the most common complaints for PHP is error handling. I've found that where it's needed, just create a class with its own error handling function(s). It's not hard, and the only limitations of an error handling system like this are the limits you put on it.

Using PHP-GTK allows me to write client-side applications that seamlessly integrate with a PHP-based server side... a serious advantage since dataset compatability is a non-issue, and combining this with various forms of encryption result in a very secure communication system.

PHP is generally distributed only as source - but it's definitely NOT a requirement. Use the Ioncube encoder to "compile" your PHP or PHP-GTK application. It's cheap - $200. You can compile a single file for just $0.50.

In my most recent, 30,000-ish line PHP-GTK application, I see acceptable performance all the way down to a P-200, though it's not "snappy" until you get up to around 400-500 Mhz PII.

Seems to me to be very similar to Java in this regard. Can anybody comment intelligibly?

PHP is the coolest language for Web development today. It provides the features of Perl but designed to be a Web development language. PHP is my primary choice if the applications doesn't demand complicated business abstractions (Java scores in such situations). Using an accelerator like ionCube will be icing-on-the-cake.

True, there is a penalty to interpreted code, but a lot of this penalty can be mitigated (in PHP at least). The folks at Zend offer their PHP accelerator, and I use the ion cube (free as in beer) on my puny home server.

Both of these compile the scripts, and parse, and validate _once_ (per reboot). For every subsequent call to the script, the server just runs the cached copy of the compiled code. So, you get all of the benefits of the scripted language, i.e. speed of coding, and fewer of the downsides.