PHP set HttpOnly property of cookies

HttpOnly is Microsoft's extension of cookies. This is primarily a matter of resolving a user's cookie may be compromised.
As we all know, when we go to the mailbox or forum login, the server will write some cookies to our browser, when the next time we visit other pages, because the browser automatically pass the cookie, so that a login can see all the need to see the content after landing. In other words, in essence, all the login states are built on cookies! Assuming that the cookie we landed on was acquired, there would be a danger of exposing personal information! Of course, think about how other people can get customers ' cookies? It must be a program of malicious people running in the browser! If it is now flying rogue software, there is no way, httponly is not to solve this situation, it is used to solve the browser JavaScript access cookie problem. Imagine a flash program running in your browser to get your cookie!
IE6 's SP1 with the support of HttpOnly, so the relative also said that still some security.

Settings in PHP

PHP5.2 above has supported the setting of the HttpOnly parameter, also supports the setting of global HttpOnly, in php.ini

-----------------------------------------------------

Session.cookie_httponly =

-----------------------------------------------------

Setting its value to 1 or true to turn on the HttpOnly property of the global cookie, and of course, supports the opening of the Code:

-----------------------------------------------------

<?php  ini_set ("Session.cookie_httponly", 1);

or  session_set_cookie_params (0, NULL, NULL, NULL, TRUE);

?>

-----------------------------------------------------

The cookie manipulation function Setcookie function and the Setrawcookie function are also specifically added with the 7th parameter as an option for HttpOnly, with the opening method:

-------------------------------------------------------

Setcookie ("abc", "Test", NULL, NULL, NULL, NULL, TRUE);

Setrawcookie ("abc", "Test", NULL, NULL, NULL, NULL, TRUE);

-------------------------------------------------------

For previous versions of PHP5.1 and PHP4 versions, you need to use the header function to work around the following:

-------------------------------------------------------------

<?php  Header ("Set-cookie:hidden=value; HttpOnly ");  ? >

-------------------------------------------------------------