PHP: Remote Kill Switch – Make Sure You Get Paid

Web Developers: Have you ever gotten to the end of a project, and had a client withhold the last of your fee to exact additional changes or features that were not in the original plan? Perhaps a client that decided your work “wasn’t what we expected” and tried to withhold payment?

Well worry no more. Put the power back in your hands with a Remote Kill Switch. The idea is this: you build into their website a small function that checks with a server you control to make sure the client’s account is in good standing. If it is, the site loads as normal. If not, their site doesn’t load, and they get a message asking for payment.

We’ll accomplish this with a little PHP and a protocol called XML-RPC (remote procedure call). Your client’s server will transmit an XML encoded, unique string identifying itself to your server. Your server will check to see if that unique string is one you’ve specified as disabled. If there is a match, it responds with a XML encoded string telling the client’s server to disable the application.

Sound like something you’d want to implement? Here’s how it breaks down:

Part One: Your server. You’ll need a fairly reliable host, and a fast one at that. You don’t want to slow down the remote application load with requests to your server. However, the below code is set to continue loading the remote application even if it does not receive a response from your server, ensuring that downtime on your end does not cause downtime on their end.

Part Two: The code on your end. Also known as the RPC server. Create a new file and paste the following:

	require('XMLRPC.inc.php');
	function checkapp($the_app)
	{
		$deactivateMe = ""; // to disable a webapp, enter it's short code here
		if (isset($the_app) && $the_app == $deactivateMe)
			return true; // Application Disabled
		else
			return false; // All systems go
	}
	$server = new IXR_Server(array('activation.checkapp' => 'checkapp'));

You’ll also need to download XMLRPC.inc.php and upload it to your webserver in the same directory as the file you created above. You will need to change the file extension from .phpp to .php.

Part Three: The client code. Also known as the RPC client. Insert this code in your client’s site, preferably toward the beginning of execution:

	require('XMLRPC.inc.php');
	$appname = "UNIQUE_APP_SHORTCODE";
	$client = new IXR_Client('http://path_to_file_created_earlier.php');
	if (!$client->query('activation.checkapp', $appname)) {
		if($client->getResponse() )
		{
			die("Application Disabled. Please pay your web developer.");
		}
	}

Again, download XMLRPC.inc.php and upload it to the server in the same directory as the file you created above. This library is required both by the client to make the request, and the server to respond to it.

That’s it! If the client ever doesn’t pay you, and you want to shutdown the site you developed for them, just set $deactivateMe in Step 1 to the “UNIQUE_APP_SHORTCODE” you entered in the code in Step 3.

You can see that the above setup allows you to protect multiple web apps at once, just remember what shortcodes you assigned at what sites! I recommend keeping them in comments at the top of your XML-RPC server PHP file. However, a limitation of my code is that you can only disable one remote site at a time. I’m sure my code could be expanded to use an array that would allow you to disable multiple sites at once.

I realize that this is significantly more technical than my typical fare (which I will return to next post), but I hope it’s helpful to some people, if only as a demonstration. Feel free to rip my code apart in the comments, I’m sure I’ve left something out.