PHP: Remote Kill Switch – Make Sure You Get Paid
Web Developers: Have you ever gotten to the end of a project, and had a client withhold the last of your fee to exact additional changes or features that were not in the original plan? Perhaps a client that decided your work “wasn’t what we expected” and tried to withhold payment?
Well worry no more. Put the power back in your hands with a Remote Kill Switch. The idea is this: you build into their website a small function that checks with a server you control to make sure the client’s account is in good standing. If it is, the site loads as normal. If not, their site doesn’t load, and they get a message asking for payment.
We’ll accomplish this with a little PHP and a protocol called XML-RPC (remote procedure call). Your client’s server will transmit an XML encoded, unique string identifying itself to your server. Your server will check to see if that unique string is one you’ve specified as disabled. If there is a match, it responds with a XML encoded string telling the client’s server to disable the application.
Sound like something you’d want to implement? Here’s how it breaks down:
Part One: Your server. You’ll need a fairly reliable host, and a fast one at that. You don’t want to slow down the remote application load with requests to your server. However, the below code is set to continue loading the remote application even if it does not receive a response from your server, ensuring that downtime on your end does not cause downtime on their end.
Part Two: The code on your end. Also known as the RPC server. Create a new file and paste the following:
require('XMLRPC.inc.php');
function checkapp($the_app)
{
$deactivateMe = ""; // to disable a webapp, enter it's short code here
if (isset($the_app) && $the_app == $deactivateMe)
return true; // Application Disabled
else
return false; // All systems go
}
$server = new IXR_Server(array('activation.checkapp' => 'checkapp'));
You’ll also need to download XMLRPC.inc.php and upload it to your webserver in the same directory as the file you created above. You will need to change the file extension from .phpp to .php.
Part Three: The client code. Also known as the RPC client. Insert this code in your client’s site, preferably toward the beginning of execution:
require('XMLRPC.inc.php');
$appname = "UNIQUE_APP_SHORTCODE";
$client = new IXR_Client('http://path_to_file_created_earlier.php');
if (!$client->query('activation.checkapp', $appname)) {
if($client->getResponse() )
{
die("Application Disabled. Please pay your web developer.");
}
}
Again, download XMLRPC.inc.php and upload it to the server in the same directory as the file you created above. This library is required both by the client to make the request, and the server to respond to it.
That’s it! If the client ever doesn’t pay you, and you want to shutdown the site you developed for them, just set $deactivateMe in Step 1 to the “UNIQUE_APP_SHORTCODE” you entered in the code in Step 3.
You can see that the above setup allows you to protect multiple web apps at once, just remember what shortcodes you assigned at what sites! I recommend keeping them in comments at the top of your XML-RPC server PHP file. However, a limitation of my code is that you can only disable one remote site at a time. I’m sure my code could be expanded to use an array that would allow you to disable multiple sites at once.
I realize that this is significantly more technical than my typical fare (which I will return to next post), but I hope it’s helpful to some people, if only as a demonstration. Feel free to rip my code apart in the comments, I’m sure I’ve left something out.
Disclaimers and warnings: You use the above code at your own risk. It is probably buggy and insecure (though it does work). I take no liability for any harm that should befall your data, your bank account, or your person as a result of implementing this idea. You should obviously remove the activation check as soon as the client has paid you for your work. It’s definitely unethical (and insecure) to leave this backdoor in place after you have finished the project. Also, this kind of system won’t work against someone who knows anything about how their site is programmed. But then again, those people probably wouldn’t be hiring freelance web developers would they?
Today in San Francisco, Steve Jobs presided over one of the more product release packed press events in recent memory. We saw the entire iPod product family overhauled – new colors on the shuffle, a total redesign of the Nano (with video), larger hard drives and lower prices on the iPod Classic (as well as a new enclosure), and the introduction of the new iPod Touch with WiFi.
The feature as it stands now is not that amazing, nor is it going to radically change many people’s lives. However, imagine the ways that location based purchasing could be extended: Pre-order the DVD/MPEG of a movie as you walk out of the theater. Buy a song’s MP3 as your favorite artist plays it on stage at a concert. Receive a coupon for 10% off upon walking into a department store, encouraging you to buy more. The possibilities are endless.
I was recently approached by someone that wanted to purchase advertising space on my blog. The offer looked something like this (numbers have been changed):
I came across a very interesting post today on the 
There are a ton of blogs out there, and sometimes it’s hard to separate the wheat from the chaff, especially when we’re talking about finance and investment banking blogs. I’ve done my best to assemble here the best of the internet: a blend of news and humor, insightful commentary and satire. There is definitely something for everyone, and plenty of sources for intra-office link sharing.
