httpOnly cookie flag support in PHP 5.2
http://ilia.ws/archives/121-httpOnly-cookie-flag-support-in-PHP-5.2.html
Thanks to a patch from Scott
MacVicar that I've just applied to CVS, PHP 5.2 will have support for
httpOnly cookie flag. This neat little feature allows you to mark a
newly created cookie as HTTP only, another words inaccessible to
browser based scripting languages such as JavaScript. This means it
would become far more difficult, if not impossible to steal a user's
cookie based session by injecting JavaScript into a page and then using
to read cookies.
This flag can be toggled by passing TRUE as the 7th parameter to the
setcookie() and the setrawcookie() functions respectively. Ex:
PHP:
<?
php
setcookie
(
"abc"
,
"test"
,
NULL
,
NULL
,
NULL
,
NULL
,
TRUE
);
setrawcookie
(
"abc"
,
"test"
,
NULL
,
NULL
,
NULL
,
NULL
,
TRUE
);
?>
The support of the httpOnly flag extends to the session extension as
well, where it can be enabled by setting the session.cookie_httponly
INI setting to 1. Or passing TRUE as the 5th parameter to the
session_set_cookie_params() function.
PHP:
<?
php
ini_set
(
"session.cookie_httponly"
,
1
);
// or
session_set_cookie_params
(
0
,
NULL
,
NULL
,
NULL
,
TRUE
);
?>
Unfortunately, at this time according to my tests no other browser has
adopted this rather handy feature, but with the continual increase of
XSS attacks, I am sure they'll adopt this concept soon.
For people using PHP 4 and PHP 5.1 you can add this flag yourself by
sending cookies manually via the header function and prefixing the
;httpOnly flag to the cookie as shown in the example below:
PHP:
<?
php
header
(
"Set-Cookie: hidden=value; httpOnly"
);
?>
相关文档：
PHP多用户在线客服系统，后台有代码镶嵌到你的系统中，不过这个是英文的，感觉很实用，简洁，方便，需要的可以自己汉化，不就是改里面的一些提示信息嘛，地址是：http://mibew.org/
，这个是开源的，支持多用户同时在线联系客服，客服后台及时性很强，只要用户点击在线客服，后台就有提示，而且可以查看聊天记录，很多实用 ......
刚学PHP的MVC,网上找来点文章学习,分享下
ASP，JSP，PHP是WEB开发的三大技术，三种技术优缺点也早就有人分析过了。无非也就是ASP简单易用且有microsoft做靠山，JSP功能强大是因为有java支持，PHP则开源跨平台。在国内，ASP应用范围最广，JSP发展势头最猛，PHP则处于劣势。这可能与公� ......
php中有两种方法：
1，通过mail()函数发送
2，Socket发送邮件
一，通过mail()函数发送：
1，需要配置php.ini邮件信息
打开php.in ......
<?php
//新建目录
mkdir("/path/to/my/dir", 0700); //0700表示权限最大
//删除目录
rmdir("/path/to/my/dir");
//遍历目录
$p =dir(/etc/php5);
echo "handler:".$p->handler;
while(false!=$entry=$p->read()){
echo $entry."\n" ;
}
$p->close();
//输出文件内容
$handle=@ ......
HTTP Only cookies without PHP 5.2
by Matt Mecham
on September 12, 2006
For a while, Microsoft have had a flag
for cookies called ‘httponly’. This doesn’t sound particularly
exciting, but it is a vital step forward for web application security.
This flag tells Internet Expl ......
