Provides various official and user-released code examples. For code reference, you are welcome to learn about the past and present of php source code security encryption. I wanted to publish it in the tutorial area. I don't know how to send it. Just write it here.
PHP encryption and decryption have always been a topic. I am a newbie. Today I will briefly introduce the principles and provide some encryption obfuscation algorithms.
One/PHP encryption is divided into the following two types:
1 \ extended component class encryption, which indicates zend \ ionCube \ SG \ php_screw \ bcompiler \ BZ2.
2 \ no extended encryption: a batch represented by a php shield.
Ii. Their security?
Component-class encryption: for extended encryption, the ZEND class indicates compiling to opcode before compression. theoretically, the source code cannot be obtained. currently, some ZEND attacks are reverse-converted to the original PHP code through OPCODE, with a good reverse effect of over 98%. php_screw and other encryption components represent xor encryption for source code, DES encryption, and so on. you must decrypt the code before running it. Such code can be cracked.
Component-free encryption: a PHP shield adds a shell to the original PHP code, similar to the shelling method of the NET program. the shell is used to decompress the base64 eval of the original code. it is finally executed through Eval. this type of code can be hijacked and eval can be restored.
3. What kind of encryption is secure?
Encryption is the most secure... This is not the same. But there is an idea that increases the difficulty of decryption. The brief process is as follows:
Encryption process: PHP source code> PHP code obfuscator> encryption (without component shell or component encryption)> encrypted finished source code.
Execution Process: load the program (without component shell or component encryption)-> PHP obfuscation code-> execute the code.
Through the above process, we can see that the PHP code is obfuscated, so the code obtained is messy. such code can still be executed, but it will make it difficult for readers to read. in addition, the security of the loaded program is critical to the shell. A good shell is the key to protecting the program.
Obfuscation of a source code. The obfuscation content that can be operated can be: PHP variable \ PHP user function \ PHP system function \ PHP class name \ PHP string, which can be encrypted. some people have said that the obfuscation effect is not good. How is it more abnormal? PHP supports variable names ranging from 127 to 255 of the ASCII code, and these characters are all garbled Chinese characters in the editor. This increases the difficulty.
4. Encryption costs and execution costs!
If only the simple encryption function name \ variable name is good, if the string is encrypted. each string operation requires a decryption operation. it will consume time and affect the system execution performance. which encryption method is worth consideration.
My Web site: http://www.phpjiami.com welcome to exchange, brick pat.
Encryptor. rar (6.89 KB download: 262 times)
AD: truly free, domain name + VM + enterprise mailbox = 0 RMB
