Yes and no...

You can use an obfuscator, it makes the code very complex to read...

or...

You can use an encoder/encrypter which makes the code impossible to read but if someone figure out your "key" they can unlock it

or...

You can compile it into binary code.

The serious hacker can break your protection no matter how you do it, you can only make it more or less difficult. If the script isn't some kind of rocket science application, chances are that no one will bother to hack it though.

Search for "php encoders" and "php obfuscators"

If you don't want people seeing your script, but you want to sell access to it, host it yourself, but write a SOAP API that gives third-party access to it. This way the files will never be hosted by the customer's server.

Good idea wayfarer, depends on what kind of application it is though and how complex it would be to make an API to allow access. It might be an elegant solution from a tech point of view but it might kill the business. Just my $0.02...

It all depends on what kind of script it is, who the buyers are and on the business model

Zend, ionCube, SourceGuardian all make decent bytecode compilers for php scripts.

Even with these, however, care needs to be taken as there are decompilers available that can reverse them. I've used Zend and ionCube (incidentally, they have a per file encryption service if you don't want to pay for the full version) and quite like ionCube.

Wayfarer and jminkler, in your opinion... how long does it in average take to make an API?

Nick, an API is nice, it lets your buyers connect from a client software and use your service. Don't forget to handle stuff like scaling, protecting the API from being used by non-paying user, proxies if you need it for outgoing stuff, maintaining an IT-infrastructure to handle all the clients and of course a disclaimer so that you don't get angry clients in case your API goes down.

Stay away from Zend. Zend is easy to break. I can take a full membership script encoded with Zend and decompile every file in the script in about 20 seconds.

Ioncube is about the only encoder solution that doesn't have a readily available decoder for it. Most people see Ioncube on scripts and don't even try to decombile them. Pretty much the only option there is to hire someone to do it for you and they charge on a per file basis so a script with hundreds of files can get very expensive to decode, usually more expensive than what it would cost to just buy the software in the first place.

Wow guys, amazing answers. Really helpful. Thanks so much, I've got a few options and things to think about now!

Cheers,

Nick

2 options:
1. IonCube to reliably encrypt script. Although IonCube is not supported by all hosting companies. If you plan to sell your script worldwide - expect tons of question like "I got IonCube error trying to run your script what do i do? I married to my hosting company and they don't support it"
2. ZenCrypt (zencrypt.com) simpler obfuscation, supported by 100% of all hosting companies and does not require any special decoders. Encrypted script self-decrypt during execution. Easier to decrypt if wanted to but protects source code nicely from peeking.

PS: I am biased - I wrote zencrypt myself just because I needed 100% support from all hosting companies. IonCube was too much hassle to deal with.

Gleb