title: Custom PHP extension security
body: <p>I would like to create a PHP extension to do some specific crystallographic functionality.</p>
  
  <ol>
  <li>Is it possible for an attacker to disassemble (or somehow xdebug) the extension to find out how it works?</li>
  <li>Could the attacker find out constants or variables which are set inside of the extension (for inst. a password, salt, etc...)?</li>
  </ol>
  
  <p><strong>UPDATE</strong></p>
  
  <p>The idea was:</p>
  
  <ul>
  <li>I want to store some data in DB encrypted, I also want to make sure that every user has his own password/salt, so nobody could access data of somebody else in case the attacker would find a hole in the access control.</li>
  <li>I could to the encryption in PHP. But if somebody gains the access to the web directory, he can easily see how I do that... he can just take the data and decrypt it at home.</li>
  <li>I could make the extension. The attacker would need gain access to the whole filesystem to get the extension. I could limit the extension use just for the server's IP address (so the attacker would not be able to take the data out from the server that easily). Wouldn't it be more secure? Is there some other way how to do it better?</li>
  </ul>