Description:
------------
---
From manual page: http://www.php.net/function.setcookie#Parameters
---

In the description of @param httponly, the sentence "This setting can 
effectively 
help to reduce identity theft through XSS attacks (although it is not supported 
by 
all browsers)," is at best controversial and perhaps even misleading. It has 
been 
widely discussed so I let you research it with Google.

---
Suggested remedy
---

I would delete the sentence altogether and replace it with a simple reference to 
RFC 6265 http://www.rfc-editor.org/rfc/rfc6265.txt  This keeps you out of the 
argument.

Alternatively, use weasel words. Try: "This setting may help to reduce 
identity..."