public static function isValidValue($value)
    {
        $value = (string) $value;

        // Look for:
        // \n not preceded by \r, OR
        // \r not followed by \n, OR
        // \r\n not followed by space or horizontal tab; these are all CRLF attacks
        if (preg_match("#(?:(?:(?<!\r)\n)|(?:\r(?!\n))|(?:\r\n(?![ \t])))#", $value)) {
            return false;
        }

        $length = strlen($value);

        for ($i = 0; $i < $length; $i += 1) {
            $ascii = ord($value[$i]);

            // Non-visible, non-whitespace characters
            // 9 === horizontal tab
            // 10 === line feed
            // 13 === carriage return
            // 32-126, 128-254 === visible
            // 127 === DEL
            // 255 === null byte
            if (($ascii < 32 && !in_array($ascii, [9, 10, 13], true)) || $ascii === 127 || $ascii > 254) {
                return false;
            }
        }

        return true;
    }
public static function isValidValue($value)
    {
        $value = (string) $value;

        // Look for:
        // \n not preceded by \r, OR
        // \r not followed by \n, OR
        // \r\n not followed by space or horizontal tab; these are all CRLF attacks
        if (preg_match("#(?:(?:(?<!\r)\n)|(?:\r(?!\n))|(?:\r\n(?![ \t])))#", $value)) {
            return false;
        }

        $length = strlen($value);

        for ($i = 0; $i < $length; $i += 1) {
            $ascii = ord($value[$i]);

            // Non-visible, non-whitespace characters
            // 9 === horizontal tab
            // 10 === line feed
            // 13 === carriage return
            // 32-126, 128-254 === visible
            // 127 === DEL
            // 255 === null byte
            if (($ascii < 32 && !in_array($ascii, [9, 10, 13], true)) || $ascii === 127 || $ascii > 254) {
                return false;
            }
        }

        return true;
    }
public static function isValidValue ( $ value ) { $ value = ( string ) $ value ; // Look for: // \n not preceded by \r, OR // \r not followed by \n, OR // \r\n not followed by space or horizontal tab; these are all CRLF attacks if ( preg_match ( "#(?:(?:(?<!\r)\n)|(?:\r(?!\n))|(?:\r\n(?![ \t])))#" , $ value ) ) { return false ; } $ length = strlen ( $ value ) ; for ( $ i = 0 ; $ i < $ length ; $ i += 1 ) { $ ascii = ord ( $ value [ $ i ] ) ; // Non-visible, non-whitespace characters // 9 === horizontal tab // 10 === line feed // 13 === carriage return // 32-126, 128-254 === visible // 127 === DEL // 255 === null byte if ( ( $ ascii < 32 && ! in_array ( $ ascii , [ 9 , 10 , 13 ] , true ) ) || $ ascii === 127 || $ ascii > 254 ) { return false ; } } return true ; }
Method to validate a header value.

Follows RFC-7230, only allows visible ASCII characters, spaces
and tabs in header value. every new line must only contains
a single CRLF and a space or tab after it.

@return  boolean  Valid or not.

@see http://en.wikipedia.org/wiki/HTTP_response_splitting
@see https://tools.ietf.org/html/rfc7230
Method to validate a header value .