Input validation must be done for all HTTP request headers.

Input validation is not needed for any HTTP request headers, as they are generated by browser and cannot be provided by users

The "Referer" header needs to be "input validated" to prevent SQL injection.

All HTTP header values can be changed/tampered using special tools like an interception proxy.