Can somebody get a constant & a variable name or value from a Zend encoded file?!

[Angry Coder]

Hello,

I am coding a license system for my scripts (encoded by Zend encoder) and I have a file with the fallowing content:

<?PHP
 
$toto = 'moto';
 
define('FOTO', 'JOTO');
 
?>

And I am afraid if some *tooot* can get the variable and/or constant name and/or value!

Is that possible?!

Many thanks...

[sweatje]

I have never really tried it, but can you do:

include zend_encoded_file.php;

var_dump(get_defined_constants());
var_dump(get_defined_vars()); 

[Angry Coder]

Can I unset a constant?!

[someonewhois]

No, once you have a define it's stuck. Why not use a variable and unset it? Constants are supposed to stay constant.

[Angry Coder]

I will try that, thank you.

By the way, anyone know how can I create a protected variable?!

[sweatje]

Have you considered encrypting any variable or constant that you want to have persist outside of your code? You could write a function to decrypt your code, have your secret hash as a parameter to the function and always do something like:

function mylib_good_stuff() {
  $foo = mylib_decrypt(MYLIB_FOO, 'mylib_secret_key_that_is_alway_a_string_not_a_var_or_define');
  ...
} 

and so on. I would think this would take you one step further along.

[Angry Coder]

Thanks but as I know encrypting functions not available at any server. Am I wrong?!

[sweatje]

perhaps you could roll your own (or google for) RC4 class if real encryption is not installed

[someonewhois]

Just write a simple encrypter (if you aren't able to do extensive encryption in math, then just swap some letters in a special way that only you know or something), and then just write a decrypt function. Basically, write an encrypt function that can change the word to a form that you know only, and then write a decrypt function, have the decrypt function Zend Encoded, then when you go to use it go mysql_connect(decrypt($localhost)... etc. (though I don't think you're using it for mysql_connect, but you get my point). In C, a lot of people don't realize this I think, but all strings you write are open in the binary file. So if you connect to an FTP account or MySQL table from C, you have to do exactly what I described, or your strings will be floating in the middle of the binary.

Hope this helped.