so header

function _deep_replace( $search, $subject ) {
$found = true;
$subject = (string) $subject;
while ( $found ) {
$found = false;
foreach ( (array) $search as $val ) {
while ( strpos( $subject, $val ) !== false ) {
$found = true;
$subject = str_replace( $val, '', $subject );
}
}
}

return $subject;
}

function remove_null($string) {
$string = preg_replace('/\0+/', '', $string);
$string = preg_replace('/(\\\\0)+/', '', $string);

return $string;
}

function hc_redirect($location, $status = 302) {
$location = hc_sanitize_redirect($location);

header("Location: $location", true, $status);
}

function hc_sanitize_redirect($location) {
$location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!]|i', '', $location);
$location = remove_null($location);

// remove %0d and %0a from location
$strip = array('%0d', '%0a', '%0D', '%0A');
$location = _deep_replace($strip, $location);

return $location;
}