sqlmapproject/sqlmap · error · SqlmapSyntaxException

invalid header value

Error message

invalid header value: %s. Valid header format is 'name:value'

What it means

_setHTTPExtraHeaders splits the --headers value into lines and validates each line: blank lines are skipped, lines starting with '@' are treated as header files, and everything else must contain at least one colon separating a non-empty header name from a non-empty value. A line failing that shape — missing colon, empty name/value, or a stray fragment — raises this SqlmapSyntaxException showing the offending line.

Solutions

1. Format each header as `Name: value`, e.g. `--headers="X-Forwarded-For: 127.0.0.1"`.
2. Separate multiple headers with newlines: `--headers="Header1: v1\nHeader2: v2"`.
3. Ensure both name and value are non-empty; remove trailing colons or empty lines.
4. To load headers wholesale, use `@/path/to/headers.txt` pointing to an existing file instead of inline lines.

When it happens

Trigger: Thrown at lib/core/option.py:1580 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/39e2d8d8e8deb02b. Report an issue: GitHub.

Appendix: source

Thrown at lib/core/option.py:1580

            conf.headers = conf.headers.replace("\\r\\n", "\\n").split("\\n")
        else:
            conf.headers = conf.headers.replace("\r\n", "\n").split("\n")

        for headerValue in conf.headers:
            if not headerValue.strip():
                continue

            if headerValue.startswith('@'):
                checkFile(headerValue[1:])
                kb.headersFile = headerValue[1:]
            elif headerValue.count(':') >= 1:
                header, value = (_.lstrip() for _ in headerValue.split(":", 1))

                if header and value:
                    conf.httpHeaders.append((header, value))
            else:
                errMsg = "invalid header value: %s. Valid header format is 'name:value'" % repr(headerValue).lstrip('u')
                raise SqlmapSyntaxException(errMsg)

    elif not conf.requestFile and len(conf.httpHeaders or []) < 2:
        if conf.encoding:
            conf.httpHeaders.append((HTTP_HEADER.ACCEPT_CHARSET, "%s;q=0.7,*;q=0.1" % conf.encoding))

        # Invalidating any caching mechanism in between
        # Reference: http://stackoverflow.com/a/1383359
        conf.httpHeaders.append((HTTP_HEADER.CACHE_CONTROL, "no-cache"))

def _setHTTPUserAgent():
    """
    Set the HTTP User-Agent header.
    Depending on the user options it can be:

        * The default sqlmap string
        * A default value read as user option
        * A random value read from a list of User-Agent headers from a
          file choosed as user option

View on GitHub (pinned to 0a35b20e39)