Nes transparently manages the removal of malicious code variables.
By default is filtered HTML and the tags Nes all environment variables (*) from forms.
By default is filtered HTML and the tags of all the variables Nes ($).
By default is filtered HTML and the tags Nes all the variables of Tables and SQL (@$).
By default HTML is allowed <br> HTML Tag.
By default, calls DBI::quote on all variables that are part of a SELECT statement in sql Tag.
The types of variables x, $ y @$ accept parameters to change this behavior:
{: $ ('var','yes_html','no_sql') :} {: * ('q_var','yes_html','no_sql') :} {: @$ ('table.field','yes_html','no_sql') :}We passed as parameters the filtering options you want, and are:
no_sql # not allow SQL, call DBI::quote no_html # not allow Tag HTML no_br # not allow Tag HTML <br> no_nes # not allow Tag Nes {: :} yes_sql # allow SQL, not DBI::quote filter yes_html # allow all Tags HTML yes_br # allow Tag HTML <br> yes_nes # allow Tag Nes {: :} Allow specific HTML tags ( yes_tag_TAG ): yes_tag_B # allow Tag HTML <B></B> yes_tag_strong # allow Tag HTML <strong></strong> ...
Format:
{: $ ('var',[list of options in any order]) :}
If we make a variable 'yes_no' will not get run code that contains the variable. For safety, you can not execute code from a Nes variable. The effect of 'no_nes' is that the tags are visible, and 'yes_no' is disappearing.
We must prevent access to these files in .htaccess:
<FilesMatch \.nes.cfg$> order deny,allow deny from all </FilesMatch>
Nes filters the Nes Tags of the forms in PHP include or Wrapper, but NOT the HTML and SQL. It is assumed that the PHP script should incorporate these filters.