Nes transparently manages the removal of malicious code variables.
By default is filtered HTML and the tags Nes all environment variables (*) from forms.
By default is filtered HTML and the tags of all the variables Nes ($).
By default is filtered HTML and the tags Nes all the variables of Tables and SQL (@$).
By default HTML is allowed <br> HTML Tag.
By default, calls DBI::quote on all variables that are part of a SELECT statement in sql Tag.
The types of variables x, $ y @$ accept parameters to change this behavior:
{: $ ('var','yes_html','no_sql') :}
{: * ('q_var','yes_html','no_sql') :}
{: @$ ('table.field','yes_html','no_sql') :}
We passed as parameters the filtering options you want, and are:
no_sql # not allow SQL, call DBI::quote
no_html # not allow Tag HTML
no_br # not allow Tag HTML <br>
no_nes # not allow Tag Nes {: :}
yes_sql # allow SQL, not DBI::quote filter
yes_html # allow all Tags HTML
yes_br # allow Tag HTML <br>
yes_nes # allow Tag Nes {: :}
Allow specific HTML tags ( yes_tag_TAG ):
yes_tag_B # allow Tag HTML <B></B>
yes_tag_strong # allow Tag HTML <strong></strong>
...
Format:
{: $ ('var',[list of options in any order]) :}
If we make a variable 'yes_no' will not get run code that contains the variable. For safety, you can not execute code from a Nes variable. The effect of 'no_nes' is that the tags are visible, and 'yes_no' is disappearing.
We must prevent access to these files in .htaccess:
<FilesMatch \.nes.cfg$>
order deny,allow
deny from all
</FilesMatch>
Nes filters the Nes Tags of the forms in PHP include or Wrapper, but NOT the HTML and SQL. It is assumed that the PHP script should incorporate these filters.