private static function validation() {
        if (isset(self::$config['validators'])) {
            $validators = self::$config['validators'];
        }
        else {
            $validators = true;
        }

        // action name validation
        if ($validators === true || (!isset($validators['actionName']) || $validators['actionName'] === true)) {
            if (substr(PHPMVC_ACTION, 0, 2) == '__') {
                throw new ActionNameValidationException();
            }
        }

        // request verification token
        $antiForgeryTokenForAction = InternalHelper::getStaticPropertyValue('\\PhpMvc\\ValidateAntiForgeryToken', 'enable');
        if ($antiForgeryTokenForAction === true || (($validators === true || (!isset($validators['antiForgeryToken']) || $validators['antiForgeryToken'] === true)) && $antiForgeryTokenForAction !== false)) {
            $request = self::$config['httpContext']->getRequest();

            if ($request->isPost()) {
                $post = $request->post();
                $expected = $request->cookies('__requestVerificationToken');

                if (!isset($post)) { $post = array(); }

                if (
                    (isset($expected) && $expected !== 'false' && (!isset($post['__requestVerificationToken']) || $post['__requestVerificationToken'] != $expected)) ||
                    (isset($expected) && $expected === 'false' && !empty($post['__requestVerificationToken'])) ||
                    (isset($post['__requestVerificationToken']) && empty($expected))
                   ) {
                    throw new HttpAntiForgeryException();
                }
            }
        }

        // cross site scripting validation
        if ($validators === true || (!isset($validators['crossSiteScripting']) || $validators['crossSiteScripting'] === true)) {
            $request = self::$config['httpContext']->getRequest();

            $get = $request->get();
            $post = $request->post();

            if (!isset($get)) { $get = array(); }
            if (!isset($post)) { $post = array(); }

            $items = array_merge($get, $post);

            foreach ($items as $key => $value) {
                $isDangerousString = CrossSiteScriptingValidation::IsDangerousString($key) || CrossSiteScriptingValidation::IsDangerousString($value);
    
                if ($isDangerousString) {
                    $source = null;

                    if (!empty($get[$key])) {
                        $source = '$_GET';
                    }
                    elseif (!empty($post[$key])) {
                        $source = '$_POST';
                    }
    
                    throw new HttpRequestValidationException($source, $key, $value);
                }
            }
        }
    }