会话Cookie没有的HttpOnly标志设置
我过不去建有一个登录系统网站。我刚刚准备好后，我曾与扫描的Acunetix，但我得到了以下信息：
I have joust built a website with a login system. After I've just got ready I have scanned it with Acunetix, but I got the following message:
会话Cookie没有的HttpOnly标志设置
会话Cookie没有安全标志设置（我想这是唯一的，如果我有SSL连接）
Session Cookie without HttpOnly flag set Session Cookie without Secure flag set (i guess this is only if I have SSL connection)
所以我的问题是，我不知道怎么可以设置的HttpOnly标志我所有的会话数据？我只是用会话当我登录的用户。我给他们一个会话与他们的用户ID号，比我使用的用户标识获取数据。
So my question would be, that how can I set HttpOnly flag for all my Session data? I'm just using sessions when I log in the users. I'm giving them a session with their userID number and than I'm getting data using that userID.
有没有简单的方法，我可以将所有会话中HTTPOnly的和安全的他们，所以没有人可以接触他们？
Is there any simple way that I can set ALL of the session HTTPOnly and secure them, so noone can touch them?
您既可以在php.ini中更改设置，或通过的ini_set（）来电更改 session.cookie_secure 和 session.cookie_httponly 值真正。
You can either change settings in php.ini, or via ini_set() calls to change session.cookie_secure and session.cookie_httponly values to true.
另外，你可以使用 session_set_cookie_params（）开始你会得到你正在寻找生效。
Alternately, you can use session_set_cookie_params() before starting your session to get the effect you are looking for.
http://us3.php.net/manual/en/function.session-set-cookie-params.php