You can find the patches for httpOnly session cookies against the PHP5
CVS HEAD in the attachment.
Now also included is support for httpOnly cookies for PHP functions
setcookie() and setrawcookie().
bool setcookie ( string name [, string value [, int expire [, string path [, string domain [, bool secure [, bool httponly]]]]] )
bool setrawcookie ( string name [, string value [, int expire [, string path [, string domain [, bool secure [, bool httponly]]]]] )
AFAIR, it was agreed not to add more parameters to these functions and overload the third parameter as an array (with new options, like a better expire option).
Nuno