Essentially, HTTPOnly makes any browser cookies from the site unreadable to javascript (in supported browsers anyway: IE7, Opera 9.5, FF3), thus raising the bar for XSS attacks considerably.

So how do we turn it on in PHP?

If you’re using a version of PHP pre5.2:

1

header("Set-Cookie: hidden=value; httpOnly");

If you’re using a new version of PHP (5.2+):

1
2
3
4
5
6
7
8
9

//Either of these options set the $_SESSION cookie into HTTPOnly mode
ini_set("session.cookie_httponly", 1);
// or
session_set_cookie_params(0, NULL, NULL, NULL, TRUE);
 
//Individual cookies can be set using:
setcookie("abc", "test", NULL, NULL, NULL, NULL, TRUE); 
//or
setrawcookie("abc", "test", NULL, NULL, NULL, NULL, TRUE);

And that’s it!
One simple line of code (or function argument) that you can add to your header file that helps makes attacks on your site tougher to execute.

Code snippets courtesy of Ilia Alshanetsky

Thankfully Gergely Hodicska has a solution on his blog.

Hopefully this sees integration into the actual plugin’s codebase at some point.

What you may not know is that the folks at google exposed this geocoding as a regular old URL-based webservice, which means that whatever Nifty mashups your devious little minds can come up with (as long as they fly with google’s TOS) can be powered on the backend without ever loading a google map!

So lets cut the chit-chat and jump to some code… I’m going to use PHP here, but do whatever fuels your nerding.

First, sign up for a key, put in whatever URL you happen to own, it won’t matter (i’ll explain later).

next, add this to your php file, making SURE to replace the key with your own:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

<?
//Three parts to the querystring: q is address, output is the format, key is the GAPI key
$key = "YOUR KEY HERE";
$address = urlencode("columbia MO");
 
//If you want an extended data set, change the output to "xml" instead of csv
$url = "http://maps.google.com/maps/geo?q=".$address."&output=csv&key=".$key;
//Set up a CURL request, telling it not to spit back headers, and to throw out a user agent.
$ch = curl_init();
 
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HEADER,0); //Change this to a 1 to return headers
curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER["HTTP_USER_AGENT"]);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
 
$data = curl_exec($ch);
curl_close($ch);
 
echo "Data: ". $data;
?>

Supposing all goes well you should see the following: (if not check the PHP CURL manual)

Data: 200,4,38.951667,-92.333889

You’ll notice that the first number is the return code, the second the relative accuracy (there 4 we see here is quite low as a result of the broad input. 8 is street-level address accuracy), third the latitude, and fourth the longitude.

So now that we’ve seen the magic.. let’s get it all nicely formatted:

1
2
3
4
5
6
7
8
9
10
11
12

//Check our Response code to ensure success
if (substr($data,0,3) == "200")
{
$data = explode(",",$data);
 
$precision = $data[1];
$latitude = $data[2];
$longitude = $data[3];
 
} else {
echo "Error in geocoding! Http error ".substr($data,0,3);
}

And that’s it! Less than 40 lines of code to give you a powerful resource for mapping and usability. Just how powerful? You’ll have to wait for part two to find out…

*Note on locations and API keys: In my experience thus far, the Geocoding service doesn’t actually check that the api key is being called from the originating server. This may change in the future at some point, so keep your eyes open.
FULL CODE LISTING:

<?
//Set up our variables
$longitude = "";
$latitude = "";
$precision = "";
 
//Three parts to the querystring: q is address, output is the format (
$key = "YOUR KEY HERE";
$address = urlencode("columbia MO");
$url = "http://maps.google.com/maps/geo?q=".$address."&amp;output=csv&amp;key=".$key;
 
$ch = curl_init();
 
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HEADER,0);
curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER["HTTP_USER_AGENT"]);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
 
$data = curl_exec($ch);
curl_close($ch);
 
echo "Data: ". $data."&lt;br&gt;";
//Check our Response code to ensure success
if (substr($data,0,3) == "200")
{
$data = explode(",",$data);
 
$precision = $data[1];
$latitude = $data[2];
$longitude = $data[3];
 
echo "Latutide: ".$latitude."&lt;br&gt;";
 
echo "Longitude: ".$longitude."&lt;br&gt;";
 
} else {
echo "Error in geocoding! Http error ".substr($data,0,3);
}
 
?>

Update:

A few people have mentioned that after some number of requests (between 100-300) in quick succession google will kill your access for the day, so you may want to insert a

sleep(1);

To stagger the requests a little.