Description:
------------
In the highly unlikely event where path or domain are user-controlled, it is possible to inject semi-colons, equals signs, etc into a value. This allows you to provide arbitrary additional key/value pairs inside of a Set-Cookie header (ie: set an expires header 20 years from now, add the HttpOnly flag, etc).

There is already sanitization in the code for checking the "value" parameter: the same logic should be applied to domain and path.

Test script:
---------------
<?php

setcookie('foo', 'bar', 0, $_GET['path'], $_GET['domain']);

Expected result:
----------------
Making a request with path=asdf;asdf&domain=foobar;%20secure results in no cookie being sent (identical to how it's currently handled when the value has invalid characters).

Actual result:
--------------
Header looks like Set-Cookie: foo=bar; path=asdf;asdf; domain=foobar; secure