CRLF Injection

Also Known As

TL;DR

Explanation

CRLF injection (\r\n) exploits insufficient sanitisation of newline characters in values that end up in HTTP response headers. An attacker who can inject \r\n can terminate the current header and begin a new one — or even split the response body to deliver a second HTTP response (HTTP Response Splitting). In PHP, header() strips newlines since PHP 7.4, but older codebases and custom header construction remain vulnerable. Always strip \r and \n from any user-supplied value before embedding it in a header.

Common Misconception

Why It Matters

Common Mistakes

• Allowing newline characters in any value passed to PHP's header() function.
• URL-decoding user input before passing to header() — %0d%0a is the encoded CRLF.
• Reflecting redirect targets directly into Location headers without stripping control characters.
• Not stripping \r and \n from user-supplied filenames in Content-Disposition headers.

Code Examples

header('Location: ' . $_GET['url']); // \r\n in url splits response

$url = str_replace(["\r", "\n"], '', $_GET['url']);
header('Location: ' . $url);

References

• ↗ https://owasp.org/www-community/attacks/CRLF_Injection
• ↗ https://www.php.net/manual/en/function.header.php

Tags

Related Terms