Cookies & ini file

Further to my earlier email, someone suggested looking at the settings within my php.ini file - I've done this, but I'm not quite sure what I'm looking for. I'm running IIS5 & PHP5. this is the cgi section of the ini file, which I think is the relevant bit - can someone give me some guidance as to what needs changing. [script] ; The root of the PHP pages, used only if nonempty. ; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root ; if you are running php as a CGI under any web server (other than IIS) ; see documentation for security issues. The alternate is to use the ; cgi.force_redirect configuration below doc_root = ; The directory under which PHP opens the script using /~username used only ; if nonempty. user_dir = ; Directory in which the loadable extensions (modules) reside. extension_dir = "./" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. enable_dl = On ; cgi.force_redirect is necessary to provide security running PHP as a CGI under ; most web servers. Left undefined, PHP turns this on by default. You can ; turn it off here AT YOUR OWN RISK ; **You CAN safely turn this off for IIS, in fact, you MUST.** ;cgi.force_redirect = 1 cgi.force_redirect = 0 ; if cgi.nph is enabled it will force cgi to always sent Status: 200 with ; every request. ; cgi.nph = 1 ; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape ; (iPlanet) web servers, you MAY need to set an environment variable name that PHP ; will look for to know it is OK to continue execution. Setting this variable MAY ; cause security issues, KNOW WHAT YOU ARE DOING FIRST. ; cgi.redirect_status_env = ; ; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) ; Set to 1 if running under IIS. Default is zero. ; fastcgi.impersonate = 1; ; cgi.rfc2616_headers configuration option tells PHP what type of headers to ; use when sending HTTP response code. If it's set 0 PHP sends Status: header that ; is supported by Apache. When this option is set to 1 PHP will send ; RFC2616 compliant header. ; Default is zero. ;cgi.rfc2616_headers = 0 [/script] Cheers Nunners