When introducing licensing to a web-based system, how should multiple instances be handled? [closed]

Question

We're taking our functional web-based software that's previously been exclusive to our business and introducing licensing options so that other businesses may use it.

What considerations should be taken into account when choosing between the two approaches:

• Modify the code to permit multiple users
• Install multiple instances of the code; one for each new user. E.G. completely duplicated, separate databases & PHP.

The software is PHP-based. We intend to offer multiple packages. Server load grows quadratically with increased use per license, due to large amounts of processing that occurs through scheduled cron jobs.

Update: despite the only answer suggesting we should not do this, we are still leaning toward modifying the code to permit multiple users. Does anyone else have any input?

Update 2: for the security reasons, we again changing our position to the multiple-instances solution.

Answer 1

Having done this myself in the last several months, My advice is don't do what we did, which is modify the code to permit multiple users. Turns out that's a rabbit hole and will introduce:

• code complexity (adding new simple features will often become difficult)
• bugs (due to increased complexity)
• security problems (a huge amount of time was spent ensuring clients cannot access each other's data)
• performance issues (tables with ~5,000 rows will suddenly grow to ~5,000,000 rows. Performance issues that weren't even noticeable suddenly created ~20 second page load times)

If we could do it again our approach would be something like:

• Put each client on a subdomain (maybe even allow them to supply their own full domain name), allowing you to have a separate apache virtual host for each one. Buying a license to something like cPanel is worth serious consideration, and investigate how to automate or semi-automate creating new accounts.

• Have a separate database for each client. Each with a different database password. This will provide excellent security and excellent performance (all the databases (and their tables) will be small).

• It's up to you whether the actual php source code should be shared between all of these clients, or have a separate copy for each one. A global directory for the files is perfectly reasonable, and will make updates easy, while a separate copy will make customisations easier. Perhaps a hybrid is the right approach here.

One day we might even end up tearing out most of the work done in the last six months, to start again with this approach.

At first glance it seems like this will increase server load, but in reality if you have enough clients for load to even be a consideration, then you will want to be able to spread clients across multiple servers. And that's a piece of cake if it's well segregated.