4 ms·
There's no need to guess. The relevant RFC sections are easily located. http://tools.ietf.org/html/rfc3875#section-3.4 http://tools.ietf.org/html/rfc3875#secti
by nknighthb 12y ago
There's no need to guess. The relevant RFC sections are easily located.
http://tools.ietf.org/html/rfc3875#section-3.4 http://tools.ietf.org/html/rfc3875#section-3.4
http://tools.ietf.org/html/rfc3875#section-4.1.18 http://tools.ietf.org/html/rfc3875#section-4.1.18
http://tools.ietf.org/html/rfc3875#section-7.2 http://tools.ietf.org/html/rfc3875#section-7.2
http://tools.ietf.org/html/rfc3875#section-9 http://tools.ietf.org/html/rfc3875#section-9
HTTP header values have some limited formatting requirements[0], but are otherwise arbitrary. There is no general way for the server to know which values are safe and which are not. That would require the server to know how the script would respond to any particular input. If that were the case, the script would be superfluous, and the server could simply respond to the client with the result it already knows the script would return!
[0] https://tools.ietf.org/html/rfc2616#section-4.2 https://tools.ietf.org/html/rfc2616#section-4.2