note 73819 deleted from function.setcookie by danbrown

Note Submitter: mbowie at NOSPAM dot buzmo dot com ---- It would seem that set_cookie will still set a cookie via HTTP, even if the secure parameter is true. So even if your site uses HTTPS/SSL to communicate sensitive data, if the initial cookie was set by set_cookie via HTTP, an attacker listening on the wire could easily spoof a visitor's cookie and gain access to their session. See: http://bugs.php.net/bug.php?id=40778