Is PHP Immune to HTTP Response Response Vulnerabilities?

Question

<?php
setcookie('test', "test\r\n<script>alert(1)</script>");
echo 1;

But it turns out that PHP automatically performs the encoding:

Set-Cookie: test=test%0D%0A%3Cscript%3Ealert%281%29%3C%2Fscript%3E

Does this mean that it is not possible to reproduce splitting the HTTP response in PHP?

Answer 1

From the Wikipedia article link :

[...] Although the separation of responses is not specific to PHP, the PHP interpreter contains protection against attacks from versions 4.4.2 and 5.1.2. ^[1]

headerand setcookiecontain mitigations against split response / header. It's impossible.