How to encode php functions

Question

I would like to encode a php page which contains some php functions.

For example, I have a page named: code.php with this functions:

<?php 
function data(){
echo "foo";
...
}

function storage(){
echo "storage files..";
...
}
?>

I use these functions in my other php pages and I would like to protect them by other users. How can I encode their code? I read about base64_encode() but the examples only show how to encode a string: how can I use this solution to encode and decode my php functions?

Thank you!

Answer 1

If you want to stop others from seeing your PHP code you can either make it as hard as possible (via minifying, obfuscating, whatever you wish to call it) or encrypt it.

There's an answer right here on SO with a few suggestions and another I'd add is ion cube.

With encrypted code you're likely to need further changes to your web server such as an apache module. With obfuscation it will just make it harder for the other developers to read, for instance changing variables and functions names to something meaningless and hard to read.

You will inevitably need to keep a copy of your unobfuscated PHP so you can work on it in a sane manner, which may be hard if you're only developing on your server.

To use Base64 you're probably thinking of doing something like this:

eval(base64_decode('ZnVuY3Rpb24gZGF0YSgpew0KZWNobyAiZm9vIjsNCn0NCmZ1bmN0aW9uIHN0b3JhZ2UoKXsNCmVjaG8gInN0b3JhZ2UgZmlsZXMuLiI7DQp9DQokZGF0YSA9ICdkYXRhJzsNCiRzdG9yYWdlID0gJ3N0b3JhZ2UnOw=='));

What's happening here is the Base 64 string is actually valid PHP, and you first decrypt it the eval it. An example of what the decoded string might look like:

function data(){
echo "foo";
}
function storage(){
echo "storage files..";
}
$data = 'data';
$storage = 'storage';

After the above eval call you would then do something like:

// call the data function
$data();

// call the storage function
$storage();

As stated from the documentation:

PHP supports the concept of variable functions. This means that if a variable name has parentheses appended to it, PHP will look for a function with the same name as whatever the variable evaluates to, and will attempt to execute it.

So, calling $someVariable() will try to run a function named whatever $someVariable contains. If you set $someVariable to foo, it would try to run foo(), if you set $someVariable to sausage, it would try to run sausage() and so on.

Obviously bear in mind that you need to make sure these function variables' names aren't going to be used elsewhere.