Re: multiline HTTP headers support in header()

Hi! > Please drop multiline HTTP headers support from PHP header() because it > was never needed in that layer, it is a security risk in combination Why it's not needed in that layer? If you want to send a multiline header allowed by RFC 2616 (assuming you do want it, for undefined reasons), how else you do that? That's the only way to send headers in PHP as far as I can see. > with a certain IE bug, IE didn't support such multiline response headers > properly anyway, and they are deprecated by RFC 7230: So IE violates the RFC by misparsing the multiline headers? I'd say it's an one more reason to never use IE :) RFC 7230 indeed proposes to remove this capability, but it's not accepted yet, as far as I can see. We can probably drop this immediately for 5.6, for previous versions I'm not sure if anybody uses this feature. So if anybody knows any use of it, please tell, otherwise it's probably a good idea to kill it for stable versions too. > I brought this to Pierre Joye's attention on Twitter today, and he > agrees that "yes it should be removed" and asked me to "drop a mail to > internals". So I just did. Thank you! -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/