Member Avatar for an00p

I have developed a web application in PHP and I wan't to implement licencing system into it so that the application should stop functioning if the licence is not renewed. Can someone help me?

  • 3 Contributors
  • 2 Replies
  • 1K Views
  • 16 Hours Discussion Span
  • Latest Post Latest Post by chrishea

Dani AI

Generated

Brief expert summary for (building on points from and ):

Licensing is an architecture choice more than a single trick. If your app is hosted by you, enforce license checks on your server and keep business-critical code there. If you must ship code to customers, treat client-side checks as “deterrence” only and design for graceful failures.

Practical, layered approach:

  • Decide distribution: hosted (strong control) vs self‑hosted (weaker control).
  • Use signed license blobs (JSON or similar) that the app verifies locally with a public key. Sign with your private key on issue; verify signature, expiry and allowed features in PHP. Keep the public key in the deployed code.
  • Require periodic server validation (short TTL tokens) but allow an offline grace period so legitimate customers aren’t locked out if the server is unreachable.
  • Move high‑value features to a remote API where possible. Obfuscation/compilation is useful as defense‑in‑depth but never the only defense.
  • Log validation failures, and provide clear renewal UX so customers prefer paying to hacking.

Minimal verification example (PHP, openssl_verify — canonicalize the license JSON before signing):

$data = file_get_contents(__DIR__.'/license.json');
$sig  = base64_decode(trim(file_get_contents(__DIR__.'/license.sig')));
$pub  = "-----BEGIN PUBLIC KEY-----\n...PEM...\n-----END PUBLIC KEY-----";
$pkey = openssl_pkey_get_public($pub);
$ok = openssl_verify($data, $sig, $pkey, OPENSSL_ALGO_SHA256);

Troubleshooting tips: check system time skew, ensure PHP has the openssl extension enabled, confirm canonical JSON used for signing, verify file permissions and clear opcode caches after deploy. Remember: no technical scheme is unbreakable — combine technical controls, monitoring, good UX, and legal terms for best results.

Recommended Answers

All 2 Replies

Member Avatar for sudeepjd

The problem with PHP is that the source is open. Anyone can change the code in order to bypass a licensing program. You should be able to encrypt your code. Refer to http://www.seocompany.ca/software/free-encryption-software.html in order to do that.

Now to write a licensing program, you need to create a license key. This can be done by using an md5 hash in assistance with some other algorithm such as rot13. In your online server, put in the key as well as the date of registration and the date of license expiry into a table. When the user loads up the PHP program, it will contact the server and check for the license details based on the registration key. This can be done with AJAX and a link to a file on the server to take, process and send the data back. This way you can also determine if the registration has expired or is due for renewal.

Member Avatar for chrishea

There are a couple of systems that you probably want to look at if you are serious about this:

seems to be pretty complete with respect to licensing. It does also seem a little bit complex to understand so you would probably need some time to experiment with it. You can install a demo copy but it didn't seem possible to do it in a local test environment so you probably need to put it on the same server you would eventually want to use it from (if you decide to buy it).

Ioncube is a pretty good PHP compiler / encrypter. You need to use this to hide the licensing and protect the code. I did quite a bit of investigation of the various options and I came to the conclusion that this is probably the best one to use. One benefit is that you can use it through their website to encrypt modules as a demo or on a pay-as-you-go basis. Source Guardian and Zend have similar encryption capabilities but the pay-as-you-go seems to be unique to Ioncube. You will find many other encrypt packages out there, but most of them can be pretty easily broken. I believe that only these three actually produce byte-code which is a semi-compiled module that needs a run-time module to decrypt it. Most servers already have the ones for Ioncube and Zend. Apparently, these can be broken as well but it is more difficult.

These aren't free options but you won't find anything free that is worth using for this. You could probably write a simple licensing module yourself but given that PHPLicengine isn't that expensive (to get something that is more than basic) it is worth considering. There may be other licensing solutions that are worth considering but this is the one that I came across.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.