Limit code to only run on one domain

[ojsimon]

Hi

I am trying to protect my php script from piracy. I do not want to use a commercial protection script, instead i was wondering if there was a bit of php code i could use to make my code only run on a certain domain specified? I could then encode this script so that they can't change this. Any ideas?

 

thanks

[Mchl]

Check $_SERVER variable. Also be aware, that if you can encode your script, someone else can decode it.

[premiso]

Check $_SERVER variable. Also be aware, that if you can encode your script, someone else can decode it.

 

Wouldn't exactly work.

 

<?php
echo $_SERVER['HTTP_HOST'] . "<br />";
$_SERVER['HTTP_HOST'] = "BLAH";
echo $_SERVER['HTTP_HOST'];
?>

 

All I Would need to do is make a mock up of your script and include the file after I set the server variable to what I want.

 

Sucks I know.

[ojsimon]

no but if i encoded this so that it was invisible.

[Mchl]

Someone would decode it so that it's visible...

I can't really think of a means to one-way encode PHP code.

[premiso]

no but if i encoded this so that it was invisible.

 

True, but then if someone decodes that and sees that check, they could easily just tell people about it and viola. They don't even need to decrypt but one page to figure that out.

 

I am just saying, if you are going to encrypt it I would do more than just a domain check. I would also make a hash in there for that domain (check the domain via the referrer on your end) that has to ping to a license deal on your server and check if that hash is valid for the domain requesting it.

 

Either way though, if they decrypt the code they will probably remove the checks. I am just saying that I would have a licensing system in there to help make it a bit harder than just setting that server variable like done above...

 

The main issue is just being able to be decoded, it really puts you off at how easy someone can do it and steal your script and use it.

[ojsimon]

What i was thinking is maybe when they buy the script they enter the domain they are going to use and it generates a serial relating to the domain, they insert this into the script config file. This is then turned into the domain and run into that script you said above. Would this work better? I understand about the encoding problem but unfortunately nothing is uncrackable, but some protection is better than none.

Thanks

[premiso]

Yep, that would be the way to go IMO. And yea, I am always with ya, at least you tried and it will keep the honest people honest without disrupting them much.