I've not attempted to implement HttpOnly cookies with EE, but doing so should be relatively straightforward. If you go to line 805 of Functions.php you'll see the setcookie() call EE uses. Directly above that is the set_cookie_end hook. As that receives the $data array of cookie params it would be trivial to create an extension with a custom setcookie() call. The following is untested but I think it should work:

function set_cookie_end($data)
{
    // Block EE's native setcookie() call
    $this-&gt;EE-&gt;extensions-&gt;end_script = TRUE; 

    // Set a HttpOnly cookie
    setcookie($data['prefix'].$data['name'], $data['value'], $data['expire'], 
        $data['path'], $data['domain'], $data['secure_cookie'], TRUE);
}


You can use Pkg.io to eliminate some of the hassle of creating the extension.

How can I enable HttpOnly cookies in EE
Which SQL-query will be executed with less time — query with WHERE-clause or without, when:


WHERE-clause deals with indexed field (e.g. primary key field)
WHERE-clause deals with non-indexed field


I suppose when we're working with indexed fields, thus query with WHERE will be faster.
Am I right?

Thanks!
