Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:75184 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 25624 invoked from network); 3 Jul 2014 01:09:19 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 3 Jul 2014 01:09:19 -0000 Authentication-Results: pb1.pair.com smtp.mail=ajf@ajf.me; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=ajf@ajf.me; sender-id=pass Received-SPF: pass (pb1.pair.com: domain ajf.me designates 192.64.116.200 as permitted sender) X-PHP-List-Original-Sender: ajf@ajf.me X-Host-Fingerprint: 192.64.116.200 imap1-2.ox.privateemail.com Received: from [192.64.116.200] ([192.64.116.200:34156] helo=imap1-2.ox.privateemail.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 31/7E-47713-E3DA4B35 for ; Wed, 02 Jul 2014 21:09:18 -0400 Received: from localhost (localhost [127.0.0.1]) by mail.privateemail.com (Postfix) with ESMTP id F2FF6B00081; Wed, 2 Jul 2014 21:09:15 -0400 (EDT) X-Virus-Scanned: Debian amavisd-new at imap1.ox.privateemail.com Received: from mail.privateemail.com ([127.0.0.1]) by localhost (imap1.ox.privateemail.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id dqEErS5isyha; Wed, 2 Jul 2014 21:09:15 -0400 (EDT) Received: from [192.168.0.15] (unknown [90.210.122.167]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.privateemail.com (Postfix) with ESMTPSA id 121E0B0007B; Wed, 2 Jul 2014 21:09:11 -0400 (EDT) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.2\)) In-Reply-To: <53B4AC6E.5050401@sugarcrm.com> Date: Thu, 3 Jul 2014 02:09:05 +0100 Cc: Solar Designer , PHP internals , D0znpp Content-Transfer-Encoding: quoted-printable Message-ID: References: <20140703003646.GA12662@openwall.com> <53B4AC6E.5050401@sugarcrm.com> To: Stas Malyshev X-Mailer: Apple Mail (2.1878.2) Subject: Re: [PHP-DEV] multiline HTTP headers support in header() From: ajf@ajf.me (Andrea Faulds) On 3 Jul 2014, at 02:05, Stas Malyshev wrote: > So IE violates the RFC by misparsing the multiline headers? I'd say = it's > an one more reason to never use IE :) RFC 7230 indeed proposes to = remove > this capability, but it's not accepted yet, as far as I can see. We = can > probably drop this immediately for 5.6, for previous versions I'm not > sure if anybody uses this feature. So if anybody knows any use of it, > please tell, otherwise it's probably a good idea to kill it for stable > versions too. As I=92ve had to implement HTTP myself for a particular non-PHP = application, I=92ve read the original HTTP/1.1 RFC. As far as I know, = multi-line headers are semantically equivalent to single-line headers, = so couldn=92t we just =93flatten=94 them automatically? It shouldn=92t = break anything unless you=92re deliberately misusing header(). -- Andrea Faulds http://ajf.me/