Security

Code Injection and Cross-site scripting

Nes transparently manages the removal of malicious code variables.

By default is filtered HTML and the tags Nes all environment variables (*) from forms.

By default is filtered HTML and the tags of all the variables Nes ($).

By default is filtered HTML and the tags Nes all the variables of Tables and SQL (@$).

By default HTML is allowed <br> HTML Tag.

By default, calls DBI::quote on all variables that are part of a SELECT statement in sql Tag.

Change the default behavior

The types of variables x, $ y @$ accept parameters to change this behavior:

{: $  ('var','yes_html','no_sql') :}
{: *  ('q_var','yes_html','no_sql') :}
{: @$ ('table.field','yes_html','no_sql') :}

We passed as parameters the filtering options you want, and are:

no_sql   # not allow SQL, call DBI::quote
no_html  # not allow Tag HTML
no_br    # not allow Tag HTML <br>
no_nes   # not allow Tag Nes {: :}

yes_sql  # allow SQL, not DBI::quote filter 
yes_html # allow all Tags HTML
yes_br   # allow Tag HTML <br>
yes_nes  # allow Tag Nes {: :}

Allow specific HTML tags ( yes_tag_TAG ):

yes_tag_B      # allow Tag HTML <B></B>
yes_tag_strong # allow Tag HTML <strong></strong>
...

Format:

{: $  ('var',[list of options in any order]) :}

Nes Tags

If we make a variable 'yes_no' will not get run code that contains the variable. For safety, you can not execute code from a Nes variable. The effect of 'no_nes' is that the tags are visible, and 'yes_no' is disappearing.

.nes.cfg

We must prevent access to these files in .htaccess:

 <FilesMatch \.nes.cfg$>
    order deny,allow
    deny from all
 </FilesMatch>
 

PHP

Nes filters the Nes Tags of the forms in PHP include or Wrapper, but NOT the HTML and SQL. It is assumed that the PHP script should incorporate these filters.