I read in a lot of articles including this and this one that we should always use a

function to encode the CR and LF special characters to prevent CRLF Injection,

but AFAIK to perform this attack the malicious user need not insert the string %0d%0a in the vulnerable page/parameter wich is already url-encoded, and when the web server render the infected response it will interpret the \r\n wich will lead to HTTP Response Splitting,

if so, then when the devloper need to use encoding ? and how it can be usefull to prevent this type of attack

  • very few platforms need to worry about "HTTP Response Splitting", which would only affect a bad low-level implementation.
    – dandavis
    Aug 7 '17 at 21:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.