HttpMessage.php
static function isValid($value)
    {
        if (!\Poirot\Std\isStringify($value))
            throw new \InvalidArgumentException(sprintf(
                'Header value must be string; given: (%s).'
                , \Poirot\Std\flatten($value)
            ));

        $value  = (string) $value;

        // Look for:
        // \n not preceded by \r, OR
        // \r not followed by \n, OR
        // \r\n not followed by space or horizontal tab; these are all CRLF attacks
        if (preg_match("#(?:(?:(?<!\r)\n)|(?:\r(?!\n))|(?:\r\n(?![ \t])))#", $value)) {
            return false;
        }

        // Non-visible, non-whitespace characters
        // 9 === horizontal tab
        // 10 === line feed
        // 13 === carriage return
        // 32-126, 128-254 === visible
        // 127 === DEL (disallowed)
        // 255 === null byte (disallowed)
        if (preg_match('/[^\x09\x0a\x0d\x20-\x7E\x80-\xFE]/', $value)) {
            return false;
        }

        return true;
    }
static function isValid($value)
    {
        if (!\Poirot\Std\isStringify($value))
            throw new \InvalidArgumentException(sprintf(
                'Header value must be string; given: (%s).'
                , \Poirot\Std\flatten($value)
            ));

        $value  = (string) $value;

        // Look for:
        // \n not preceded by \r, OR
        // \r not followed by \n, OR
        // \r\n not followed by space or horizontal tab; these are all CRLF attacks
        if (preg_match("#(?:(?:(?<!\r)\n)|(?:\r(?!\n))|(?:\r\n(?![ \t])))#", $value)) {
            return false;
        }

        // Non-visible, non-whitespace characters
        // 9 === horizontal tab
        // 10 === line feed
        // 13 === carriage return
        // 32-126, 128-254 === visible
        // 127 === DEL (disallowed)
        // 255 === null byte (disallowed)
        if (preg_match('/[^\x09\x0a\x0d\x20-\x7E\x80-\xFE]/', $value)) {
            return false;
        }

        return true;
    }
static function isValid ( $ value ) { if ( ! \ Poirot \ Std \ isStringify ( $ value ) ) throw new \ InvalidArgumentException ( sprintf ( 'Header value must be string; given: (%s).' , \ Poirot \ Std \ flatten ( $ value ) ) ) ; $ value = ( string ) $ value ; // Look for: // \n not preceded by \r, OR // \r not followed by \n, OR // \r\n not followed by space or horizontal tab; these are all CRLF attacks if ( preg_match ( "#(?:(?:(?<!\r)\n)|(?:\r(?!\n))|(?:\r\n(?![ \t])))#" , $ value ) ) { return false ; } // Non-visible, non-whitespace characters // 9 === horizontal tab // 10 === line feed // 13 === carriage return // 32-126, 128-254 === visible // 127 === DEL (disallowed) // 255 === null byte (disallowed) if ( preg_match ( '/[^\x09\x0a\x0d\x20-\x7E\x80-\xFE]/' , $ value ) ) { return false ; } return true ; }
Validate a header value.

Per RFC 7230, only VISIBLE ASCII characters, spaces, and horizontal
tabs are allowed in values; header continuations MUST consist of
a single CRLF sequence followed by a space or horizontal tab.

@see http://en.wikipedia.org/wiki/HTTP_response_splitting
@param string $value
@return bool
Validate a header value .