Question

I have searched and found another with quite close question but the result was YUI Compressor and I didn’t find that useful.

I use php to obfuscate my JavaScript code but it is not enough. I need a php script that I can run and then rename all functions and variables to random names (only letters) and ofcause before I obfuscate.

I have seen a few but they are either standalone programs like Java or something you need to pay for, and I can’t use that.

Does anyone know a class or code snippet that might be able to do that?

And if the YUI Compressor actually can do that, can anyone point out some help to how I implement it into php?

Answer 1

After writing this long-winded response I began to wonder why you need to obfuscate javascript code in the first place? Javascript code is by nature public and anyone looking at your page can see the result. If you have secret/proprietary things you need to do, look into something like AJAX or otherwise making a callback to your server to do the processing and have it spit out the results for javascript. Any processing you do in javascript will be visible by anyone. Obfuscating just makes debugging harder, and isn’t guaranteed to keep someone from cracking the code.

In general use javascript to control presentation, parse results from a server call into the document, and validate user input. Anything secret you want done, do on the server side where they can’t see the exact code that is going on.

And with that off my chest here is my response if you still want to go the renaming route:

I haven’t taken the time to Google what a YUI compressor is yet, but what you’re describing sounds like you would need to parse any javascript and from there go about renaming functions and variables. I see a few issues

• If/when your javascript uses built-in variable names like document or window and like-wise built-in functions like .getElementById(). Those you can’t touch or the script can’t do what it was meant to do.

• Javascripts are executed in the context of the browser and might use functions/variables from other javascript files ex an HTML like

  <script type="text/javascript" src="a.js"></script>
  <script type="text/javascript" src="b.js"></script>
  

  Since b.js was included after a.js, b.js can refer to and use any functions or variables in a.js thus if you scramble the names you will have to make sure any references made in b.js are updated to your new names appropriately.

• Depending on how often you are wanting to do this renaming you have a trade off of having the code being cracked easier vs completely trashing the browser cache

  • Modify the names just once and keep the results – then browsers will cache the responses correctly and your site should work pretty well, however since the names are consistant between calls it will be easier for someone to crack the renaming. Though for this solution you don’t necessarily need PHP, just any language or script and run it once
  • Modify the names per session – probably the best solution and middle of the road though it would require you to keep extra memory associated with each session as to the name changes so any requests for new java script files from the same session get renamed as they should (most modern browsers and server settings will allow for caching of the same named javascript file so as described in point 2 if any functions/variables in a.js are used by another javascript file they will have to be updated accordingly
  • Modify javascript files per request – this may require you to disable caching of your javascript files as every request for a page will require downloading a new javascript file(s) even if the user reloads the same page. This will lower page loading performance considerably (you have to rename all the functions again and generate a new javascript file, that is then downloaded by the browser and parsed by it) and also increase bandwidth consumption, however no two scripts for a page will be alike.

Overall this doesn’t seem like a 1 man (or even 2 or 3 man) project that you want to undertake (unless you have a lot of time on your hands, but then things will have changed), there could be something like this out there already or something close which you could fork off of and modify to your needs. Essentially I think what you are wanting to do would be more work than its worth.