%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

              Pascal Web Unit (PWU) Security

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


-----------------------------------------------------------------
 [ Security Introduction ]                                                 
-----------------------------------------------------------------

 Security is not handled in the configuration file, but rather
 in the actual programming. Read more to find out why.

 Security is handled in the pwu.pp unit automatically by 
 default.
 Level 2 Security is used by default, by passing number 2 to
 the _S and _SF suffix functions through the wrappers like
 WebFormat.

 To bypass level 2 security, use functions with the
 _S and_SF prefix directly (i.e. WebFormat_S), where you can 
 specify level 0, 1, or 2 security explicitly. 

 In other words, automatic security is always on, and manual 
 security controlled by the programmer's choice of functions,
 not by configuring a fixed, inflexible security setting in 
 this configuration file. Many times, the programmer will
 want security partially on for certain functions, and
 completely on for other ones, due to different filtering
 requirements. 

 Example:
  Security in web programming is not fixed and does not stay the 
  same throughout a program's entire life. One may want to 
  allow html  symbols as input for a web forum's "post message" 
  edit box,  but not allow html symbols in the web forum's 
  "user name" input box. 
  
  For this reason, you use functions with _S and _SF suffixes 
  in pwu.pp only when you need to bypass the default security 
  level of 2. 

-----------------------------------------------------------------
 [ Levels of Security ]                                                 
-----------------------------------------------------------------

Level 2
  The highest level of security for a function, protecting from 
  cross site scripting (XSS) and malicioius input
  DEFAULT LEVEL

Level 1 
  Medium level of security, leaving out some characters
  for when you want extra features in the program which
  use those characters.

Level 0
  No security, your own custom security. Use this when you are 
  implementing your own filtering methods, or when you are using 
  the FilterHTML function. 
  
  
Example of why you would need Level 0 security:

  You may have a special website that lets administrators insert 
  dollar symbols into your store database for dollar pricing, or 
  something similar.

  Usually a dollar symbol as input is a malicious attempt, and 
  is insecure. So it is trimmed (deleted) or replaced with an HTML 
  equivilent symbol by default. But in a special case like
  this store database, where administrators may be updating
  pricing with dollar signs in a special case, you would want to
  allow the dollar symbol in as a true dollar symbol character.
  You can therefore use Level 0, and implement your own
  filtering and checking, such as letting dollar signs in
  but no other special characters.
  
  Again these are rare cases, so usually default security is
  what you will be using. In the above example, you would be
  better off just designing your database so that it doesn't
  need actual dollar symbol input.. but if it DOES, that is
  okay. You will only be bypassing default security in those 
  special situations with level 0, using the _SF and _S suffix
  functions in pwu.pp. 
  (pass 0 as one of the Security parameters)

